7 ms·

Won't matter. They care about hitting the average user who won't know what the hell this special p2p dns lookups are. If the power users get away with it fine,

Won't matter. They care about hitting the average user who won't know what the hell this special p2p dns lookups are. If the power users get away with it fine, as long as 99.9% of the population comply.

Charuru 16y ago
Maybe I'm not understanding correctly, but the dns lookups will be built into torrent apps, which everyone uses. So rather than go to piratebay.org the user would open utorrent and use the utorrent browser. This will not be significantly harder.
- dan_netwalker 16y ago
  No, he means when you open your browser and type "www.piratebay.p2p", some program under the hood will 1) connect to a tracker, 2) get the ip from the tracker in a similar fashion to what bittorrent does to get seeds and 3) continue with the navigation as always. By connecting to this tracker, the translation from "www.someplace.com" to 12.13.14.15 (what the machine really understands) is done regardless what the ICANN dns says. No way to redirect to a "this page is closed" server, no web page can be cut off the internet. Check mate.
  - randallsquared 16y ago
    Check mate. This game is far from over. Filtering web requests based on the requested host is enough to disrupt this, and even SSL requests send cleartext hosts (sadly).
    - dan_netwalker 16y ago
      You are right, this war is far from over. Just I wasn't considering the whole war, but this battle, this game in particular. We'll see how the next battle starts, and then we'll play our moves the best we can, but this time, in this game to be precise, I think is a check mate. And a speedy one, too. Maybe.
Estragon 16y ago
The average user doesn't need to know about special p2p dns lookups. He just has to be able to download a bittorrent client which knows how to do a p2p dns lookup.
jrockway 16y ago
Two thoughts: The power users run the DNS caches. Nobody uses DNSSEC, so it's still easy to poison DNS caches. Power users know how to do this, and can "poison" the DNS caches with the correct entries instead of the government-sanctioned alternatives. I'm getting some popcorn. This will be fun to watch.
- trotsky 16y ago
  Nobody uses DNSSEC, so it's still easy to poison DNS caches I'm not sure if that's accurate - I believe source port randomization has made it extremely difficult to poison recursive DNS servers. I think a recent "successful" attack on source port randomizing showed it took them 7 hours on a 10Gb/s link to poison one A entry.
  - jrockway 16y ago
    4chan has 7 hours and a 10Gb/s link.
    - trotsky 16y ago
      per resolver
      - jrockway 16y ago
        per resolver. Think about how much bandwidth is used every day for downloading porn. Use 1% of that for poisoning DNS, and DNS points wherever the poisoners want it to.

Charuru 16y ago

Maybe I'm not understanding correctly, but the dns lookups will be built into torrent apps, which everyone uses. So rather than go to piratebay.org the user would open utorrent and use the utorrent browser. This will not be significantly harder.

dan_netwalker 16y ago
No, he means when you open your browser and type "www.piratebay.p2p", some program under the hood will 1) connect to a tracker, 2) get the ip from the tracker in a similar fashion to what bittorrent does to get seeds and 3) continue with the navigation as always. By connecting to this tracker, the translation from "www.someplace.com" to 12.13.14.15 (what the machine really understands) is done regardless what the ICANN dns says. No way to redirect to a "this page is closed" server, no web page can be cut off the internet. Check mate.
- randallsquared 16y ago
  Check mate. This game is far from over. Filtering web requests based on the requested host is enough to disrupt this, and even SSL requests send cleartext hosts (sadly).
  - dan_netwalker 16y ago
    You are right, this war is far from over. Just I wasn't considering the whole war, but this battle, this game in particular. We'll see how the next battle starts, and then we'll play our moves the best we can, but this time, in this game to be precise, I think is a check mate. And a speedy one, too. Maybe.

Estragon 16y ago

The average user doesn't need to know about special p2p dns lookups. He just has to be able to download a bittorrent client which knows how to do a p2p dns lookup.

jrockway 16y ago

Two thoughts: The power users run the DNS caches. Nobody uses DNSSEC, so it's still easy to poison DNS caches. Power users know how to do this, and can "poison" the DNS caches with the correct entries instead of the government-sanctioned alternatives. I'm getting some popcorn. This will be fun to watch.

trotsky 16y ago
Nobody uses DNSSEC, so it's still easy to poison DNS caches I'm not sure if that's accurate - I believe source port randomization has made it extremely difficult to poison recursive DNS servers. I think a recent "successful" attack on source port randomizing showed it took them 7 hours on a 10Gb/s link to poison one A entry.
- jrockway 16y ago
  4chan has 7 hours and a 10Gb/s link.
  - trotsky 16y ago
    per resolver
    - jrockway 16y ago
      per resolver. Think about how much bandwidth is used every day for downloading porn. Use 1% of that for poisoning DNS, and DNS points wherever the poisoners want it to.