4 ms·
Would this system block websites at the IP level or at the DNS level? Doing it at the DNS level would mean you could roll your own DNS or use a non-US DNS prov
by iwr 16y ago
Would this system block websites at the IP level or at the DNS level?
Doing it at the DNS level would mean you could roll your own DNS or use a non-US DNS provider.
Doing it at the IP level would mean banned IPs and reverse-lookups of IPs back into domain names, checking against a list of banned domains. This one could only be bypassed through proxies.
- navyrain 16y agoMy understanding of it is that US nameservers couldn't resolve banned domains. Anyone with the tiniest bit of technical knowledge could use an untainted nameserver, or run their own. However, the spirit of the bill is terribly misguided, no matter how easy it is to circumvent.
- tomjen3 16y agoThats exactly what they did with the free-speech filter in Denmark (which they said was only supposed to block child-porn). I know at least one dorm where the geeks just changed the DNS servers for everyone.
- olefoo 16y agoOne of the downsides of allowing legislation like this that imposes compliance requirements on organizations is that it creates widespread law-breaking by the otherwise law-abiding. It can also inadvertently stifle key technical standards. Would you be willing to switch on DNSSEC validation in client side software (browsers, operating systems) if it only talks to nameservers that are compliant with government censorship? Yes, this is a stupid law, but it's technical implementation is possible because there is a single root for public DNS.