Comment by wtmt | Hacker News Reader

Comment by wtmt | Hacker News Reader

In India, several websites get blocked by different ISPs based on some highly unsubstantiated petitions to some court that doesn’t understand what the right move is and just sends the list of domains to be blocked to some ISPs, who gladly comply without any checks or questions. Users see a message saying that the site has been blocked because of some order from the Department of Telecommunications.

There is no grievance management process, no way for legitimate sites to get a quick reprieve when they get blocked either due to operator error or issues with the petitions not being vetted and investigated for malicious intent (a competitor could easily knock you off in some states or regions and you wouldn’t even know).

While there are activists working on policies and campaigning for better laws, we really need stronger technological solutions against these (usually ridiculous) blocks that insult “due process” and harm people.

India is also very quick to rap on large multinational companies whenever they seem to provide something that those in power (or their supporters) frown upon. So centralized providers like Google DNS or Cloudflare DNS would have some tough times with the governments, since both have physical presence in the country with their servers/data centers.

A decentralized and yet secure/private DNS may be more resilient than these DoC (DNS over Cloud) providers if we have to deal with government censorship effectively.

One of the options I've thought of (and I'm sure many others have as well) is to have all zones distributed in a P2P manner via ICANN. To not put too much burden on ICANN and keep things decentralized, have ICANN at the root of the DNS PKI and have all zones signed by the responsible party.

This would solve a few of the big problems we have:

* All sorts of MITM and evil resolver attacks would be prevented.

* Since DNS queries are local, there would no longer be a privacy concern with resolving a name.

* Even if the P2P network mechanism were to be blocked, since every host connected keeps a full record (though not necessarily with history) it can still be distributed via sneakernet.

* DNS updates are as fast as the network is, no longer depending on turtles caching all the way down.

* DNS amplification? That's gone, as resolvers no longer need to query external sources.

As many will quickly notice, we would likely still need remote resolvers for battery constrained devices as this would keep the network interfaces busy.

The one big political issue that would put a stop to this is that this would cause all zones to be world readable. Many people treat zones as something private and to them exposing the zone file is the same as exposing their network. My view is that if it has a publically routable IP then it is already exposed, but not everyone shares my view.

I've also thought of this. With the plentiful availability of storage and bandwidth we have today, there is little technical reason why public resolvers and privacy minded individuals couldn't download and cache zone files in bulk.

As you say though, I suspect the inertia behind the status quo is so strong that there is little chance of such a radical change being accepted.

> The one big political issue that would put a stop to this is that this would cause all zones to be world readable. Many people treat zones as something private and to them exposing the zone file is the same as exposing their network. My view is that if it has a publically routable IP then it is already exposed, but not everyone shares my view.

I really don’t get this view either. There may be more cases supporting zone files being world readable than not (I can’t think of any cases for the latter except for censorship and control).

The concerns just don't stop with blocking access but privacy as well: Some ISPs, I'd wager, are intercepting all unencrypted traffic too https://news.ycombinator.com/item?id=12091900. As long as one types in https instead of http, DNS and content based censorship should stop working, at least in theory, if one can use custom DNS providers over TLS, Https, or DNSCrpyt.

On Android, consider installing intra https://getintra.org to use a DNS over Https server of your choice, and switch to using Firefox instead of Chrome (someone pointed out in comments here that Chrome uses its own DNS resolver).

An example of how to set up AdGuard DNS (privacy oriented) on Android 4 and later: https://news.ycombinator.com/item?id=18791895

On Windows, consider using SimpleDNSCrpyt https://simplednscrypt.org/

----

Generally you could try and setup pie-hole, as well: https://news.ycombinator.com/item?id=18075159

Anecdotal: DNS based censorship and blocking used to be a thing back in the day in India, but things have moved on to other methods (sni based I think).

This probably may be true for some ISPs, but is not true everywhere. I still see sites blocked when visiting the http version, while they go through fine when visiting the https version. That means they’re not doing SNI inspection, right?

Reply on news.ycombinator.com