4 ms·

You are free to choose your DNS provider. On the other hand if we take your view and apply it in reverse: why should an American or Chinese person trust the EU

You are free to choose your DNS provider. On the other hand if we take your view and apply it in reverse: why should an American or Chinese person trust the EU to regulate the internet? DNS roots have worked flawlessly. The EU can just create EU roots and be in control of them and regulate those. Nobody is opposed to that. You can even enforce vendors to only include EU roots when selling devices in the EU (I’m against this personally) or to ISPs (I’m more okay with this). But as a person who loves the EU I’m very much opposed to enforcing EU values and views to 3rd parties.

oaiey 5y ago
No normal users chooses a DNS server. Everyone should regulate and audit them. How we do with medical devices, and other stuff. The internet is no unicorn with special treatment. The last paragraph is right until I think about my EU-WhatsApp trying to make connections in Singapore. They try to protect me as a citizen.
- EricE 5y ago
  What value would regulation bring to a system that is currently working, has worked flawlessly for over 40 years and shows no need of imminent "improvement" from a law like this. Exactly what problem would this law saw? So far all I am seeing are vaugue assurances and warm feelings but zero substance of how it would improve anything. Indeed, if history is our guide any change is far more likely to hurt rather than help. Therefore it is incumbent on those seeking the change to defend it - how exactly will this law "improve" things. Please be specific and factual and leave feelings to the poets and philosophers.
  - oaiey 5y ago
    So the argument is: medical devices yes, internet which is used for everything: no. Not every jurisdiction in the world is based on extreme fines (like the US) but many are build on strict regulations (like most European countries). Personally, i cannot speak about the concrete law and nis 2 thingy.
- renewiltord 5y ago
  You control the client. Don't ask my server if you don't want to. I'm not making you do it. If you want to ask my server, send me information in the protocol that says that you want me to meet a certain standard and I'll blackhole the request if I can't meet it. This is how SSL/TLS works and it works well.
- martimarkov 5y ago
  Fine then enforce that: Any software that is used by EU citizens (downloaded from EU App Store or EU vendor website) should use EU DNS servers. (The user should be allowed to change the DNS on per device and per app lvl) I’d be okay with that. And I think that solves your issue, my issue and EU’s issue.
  - guitarbill 5y ago
    Is that feasible for millions or billions of already manufactured, exiting devices?
    - martimarkov 5y ago
      Simply - no. Devices that are old enough which have no OS updates then... no. But any new device or already supported ones: yes why not. It's just an update from the manufacturer. You can even say: If the device is within EOL<1 year just update the DNS to the EU DNS. Other devices will need to have the option of choosing DNS addresses. Another approach is what we do with cars: we don't ban ICE cars, we have different "tiers" (Euro5, Euro6) of emissions and phase them out. We can do the same thing. Any device manufactured after 2020 will need to implement this "feature". It will take a few years to propagate but it is a very feasible approach.
    - zepearl 5y ago
      Don't most devices use just DHCP, which in turn in most cases just use the DNS settings of the Internet Provider (IP) that is being used (indirectly, as usually the local router is set like that) => if a local government asks the IPs to use specific root servers then the problem should be solved? (or maybe I'm not understanding the core problem...)
guitarbill 5y ago
> But as a person who loves the EU I’m very much opposed to enforcing EU values and views to 3rd parties. I'm not quite clear how that's different from ICANN? Ostensibly they're now "multistakeholder", but were under the United States Department of Commerce until 2016. And were infamously in denial about the GDPR impact to WHOIS. To be clear, I'm not saying the EU proposal is in any way good, I have no idea. But this issue has been brewing for a while, and I don't think it's unreasonable to be critical of ICANN et al and preparing for eventualities. Even if it is the status quo, leaving a major part of the internet in the hands of some unaccountable NGO is a huge risk.
Skunkleton 5y ago
There is less and less choice over your DNS provider. With the classic DNS protocol, requests were routinely hijacked by ISPs. With new protocols like DOH, you now have to go manually configure every application and cross your fingers it does what you want. Not everything can be configured to a specific DOH gateway. As it stands today, I can no longer reliably block hosts by domain name on my own network thanks to DOH.
- readams 5y ago
  This is a completely separate problem and not related to the root DNS servers. As an individual user, you do not contact the roots.
- setBoolean 5y ago
  This really rubs me the wrong way about DoH. At the moment I mitigate this by outright blocking the Top 10 public DNS servers network wide.
- Aeolun 5y ago
  > As it stands today, I can no longer reliably block hosts by domain name on my own network thanks to DOH. You should be able to mitm all your own https traffic right? Not sure if that’s worth it though.
  - Skunkleton 5y ago
    If you were to MITM, that would mean all HTTPS connections, not just DOH.
    - Aeolun 5y ago
      Well yeah, but you’re not really afraid of knowing your own traffic right?
      - Skunkleton 5y ago
        No, but I am a little afraid of doing a bad job with my MITM server and exposing myself to vulnerabilities.
petre 5y ago
> You can even enforce vendors to only include EU roots when selling devices in the EU Please don't give them ideas. Not even the Kremlin has done that, although they did something similar with geolocation devices. Otherwise I fully agree. If the EU wants to audit, they should establish their own root server infrastructure, pay for it and audit that. If I was a root server operator providing what is essentially a free service and this was enforced on me, I'd rather shut down or block EU netblocks than be bothered by EU cyber security auditors.
- martimarkov 5y ago
  I mean if it’s done in the right way and actually hosted by universities with high reputation: Oxford/Cambridge/Southampton (obvs not in Europe anymore but it illustrates my point) then I think it might be okay. Nothing wrong with making sure dns works in Europe if all other dns roots fail. The implementation part will be tricky but not impossible. Heck ipv6 is still not rolled out and we actually need it. Do you think they will be able to do this faster?
Aeolun 5y ago
> I’m very much opposed to enforcing EU values and views to 3rd parties. I’m not at all opposed to the EU trying to regulate companies providing services to their citizens. If you only regulate providers in the EU it’s a pointless exercise from the start, even if you don’t have a lot of ways to actually enforce your regulations.

oaiey 5y ago

No normal users chooses a DNS server. Everyone should regulate and audit them. How we do with medical devices, and other stuff. The internet is no unicorn with special treatment. The last paragraph is right until I think about my EU-WhatsApp trying to make connections in Singapore. They try to protect me as a citizen.

EricE 5y ago
What value would regulation bring to a system that is currently working, has worked flawlessly for over 40 years and shows no need of imminent "improvement" from a law like this. Exactly what problem would this law saw? So far all I am seeing are vaugue assurances and warm feelings but zero substance of how it would improve anything. Indeed, if history is our guide any change is far more likely to hurt rather than help. Therefore it is incumbent on those seeking the change to defend it - how exactly will this law "improve" things. Please be specific and factual and leave feelings to the poets and philosophers.
- oaiey 5y ago
  So the argument is: medical devices yes, internet which is used for everything: no. Not every jurisdiction in the world is based on extreme fines (like the US) but many are build on strict regulations (like most European countries). Personally, i cannot speak about the concrete law and nis 2 thingy.
renewiltord 5y ago
You control the client. Don't ask my server if you don't want to. I'm not making you do it. If you want to ask my server, send me information in the protocol that says that you want me to meet a certain standard and I'll blackhole the request if I can't meet it. This is how SSL/TLS works and it works well.
martimarkov 5y ago
Fine then enforce that: Any software that is used by EU citizens (downloaded from EU App Store or EU vendor website) should use EU DNS servers. (The user should be allowed to change the DNS on per device and per app lvl) I’d be okay with that. And I think that solves your issue, my issue and EU’s issue.
- guitarbill 5y ago
  Is that feasible for millions or billions of already manufactured, exiting devices?
  - martimarkov 5y ago
    Simply - no. Devices that are old enough which have no OS updates then... no. But any new device or already supported ones: yes why not. It's just an update from the manufacturer. You can even say: If the device is within EOL<1 year just update the DNS to the EU DNS. Other devices will need to have the option of choosing DNS addresses. Another approach is what we do with cars: we don't ban ICE cars, we have different "tiers" (Euro5, Euro6) of emissions and phase them out. We can do the same thing. Any device manufactured after 2020 will need to implement this "feature". It will take a few years to propagate but it is a very feasible approach.
  - zepearl 5y ago
    Don't most devices use just DHCP, which in turn in most cases just use the DNS settings of the Internet Provider (IP) that is being used (indirectly, as usually the local router is set like that) => if a local government asks the IPs to use specific root servers then the problem should be solved? (or maybe I'm not understanding the core problem...)

guitarbill 5y ago

> But as a person who loves the EU I’m very much opposed to enforcing EU values and views to 3rd parties. I'm not quite clear how that's different from ICANN? Ostensibly they're now "multistakeholder", but were under the United States Department of Commerce until 2016. And were infamously in denial about the GDPR impact to WHOIS. To be clear, I'm not saying the EU proposal is in any way good, I have no idea. But this issue has been brewing for a while, and I don't think it's unreasonable to be critical of ICANN et al and preparing for eventualities. Even if it is the status quo, leaving a major part of the internet in the hands of some unaccountable NGO is a huge risk.

Skunkleton 5y ago

There is less and less choice over your DNS provider. With the classic DNS protocol, requests were routinely hijacked by ISPs. With new protocols like DOH, you now have to go manually configure every application and cross your fingers it does what you want. Not everything can be configured to a specific DOH gateway. As it stands today, I can no longer reliably block hosts by domain name on my own network thanks to DOH.

readams 5y ago
This is a completely separate problem and not related to the root DNS servers. As an individual user, you do not contact the roots.
setBoolean 5y ago
This really rubs me the wrong way about DoH. At the moment I mitigate this by outright blocking the Top 10 public DNS servers network wide.
Aeolun 5y ago
> As it stands today, I can no longer reliably block hosts by domain name on my own network thanks to DOH. You should be able to mitm all your own https traffic right? Not sure if that’s worth it though.
- Skunkleton 5y ago
  If you were to MITM, that would mean all HTTPS connections, not just DOH.
  - Aeolun 5y ago
    Well yeah, but you’re not really afraid of knowing your own traffic right?
    - Skunkleton 5y ago
      No, but I am a little afraid of doing a bad job with my MITM server and exposing myself to vulnerabilities.

petre 5y ago

> You can even enforce vendors to only include EU roots when selling devices in the EU Please don't give them ideas. Not even the Kremlin has done that, although they did something similar with geolocation devices. Otherwise I fully agree. If the EU wants to audit, they should establish their own root server infrastructure, pay for it and audit that. If I was a root server operator providing what is essentially a free service and this was enforced on me, I'd rather shut down or block EU netblocks than be bothered by EU cyber security auditors.

martimarkov 5y ago
I mean if it’s done in the right way and actually hosted by universities with high reputation: Oxford/Cambridge/Southampton (obvs not in Europe anymore but it illustrates my point) then I think it might be okay. Nothing wrong with making sure dns works in Europe if all other dns roots fail. The implementation part will be tricky but not impossible. Heck ipv6 is still not rolled out and we actually need it. Do you think they will be able to do this faster?

Aeolun 5y ago

> I’m very much opposed to enforcing EU values and views to 3rd parties. I’m not at all opposed to the EU trying to regulate companies providing services to their citizens. If you only regulate providers in the EU it’s a pointless exercise from the start, even if you don’t have a lot of ways to actually enforce your regulations.