3 ms·

DNS is distributed, you can always run your own resolver https://openwrt.org/docs/guide-user/services/dns/unbound https://openwrt.org/docs/guide-user/services/d

DNS is distributed, you can always run your own resolver https://openwrt.org/docs/guide-user/services/dns/unbound https://openwrt.org/docs/guide-user/services/dns/unbound

s800 5y ago
Have there been any attempts/successes to issue injunctions against roots?
nerdbaggy 5y ago
I wonder if any legislation can make the root servers block things
- JoshTriplett 5y ago
  It could make the root server hosted in one country do so, at which point hopefully the other roots would simply de-list that faulty root server (and start seeking to establish another root server elsewhere).
- giobox 5y ago
  The root servers (ICANN) are still under the remit of the US department of commerce, so it’s theoretically possible for US legislation at least.
- 0xcde4c3db 5y ago
  I might be misunderstanding something since I've never been a DNS expert, but wouldn't root servers only be able to block at the level of entire TLDs? Not to say that governments couldn't be interested in doing that, but the flexibility seems limited (without e.g. requiring the root server to return government-approved servers and implementing the blocking on those servers).
  - deleted 5y ago
    [deleted]
- nybble41 5y ago
  Unless they wanted to delist an entire country for some reason it's the TLD servers they would need to go after, not the root servers. And yes, they could attempt to go after the TLD itself and not just the ISP's caching recursive resolver. This is why distributed, censorship-resistant domain resolution is so important. The Internet may be distributed and capable of routing around censorship, but the current DNS system is relatively centralized and thus vulnerable to attack.
cesarb 5y ago
I have run my own DNS resolver since that time when VeriSign decided to hijack all unregistered .com and .net domains (https://en.wikipedia.org/wiki/Site_Finder); https://en.wikipedia.org/wiki/Site_Finder); by running your own recursive DNS resolver, it could detect the hijacked responses and turn them back into the correct NXDOMAIN response.
bwoodcock 5y ago
The entire point of this injunction is that it can be applied to people running their own resolvers.

DNS is distributed, you can always run your own resolver https://openwrt.org/docs/guide-user/services/dns/unbound https://openwrt.org/docs/guide-user/services/dns/unbound

s800 5y ago

Have there been any attempts/successes to issue injunctions against roots?

nerdbaggy 5y ago

I wonder if any legislation can make the root servers block things

JoshTriplett 5y ago
It could make the root server hosted in one country do so, at which point hopefully the other roots would simply de-list that faulty root server (and start seeking to establish another root server elsewhere).
giobox 5y ago
The root servers (ICANN) are still under the remit of the US department of commerce, so it’s theoretically possible for US legislation at least.
0xcde4c3db 5y ago
I might be misunderstanding something since I've never been a DNS expert, but wouldn't root servers only be able to block at the level of entire TLDs? Not to say that governments couldn't be interested in doing that, but the flexibility seems limited (without e.g. requiring the root server to return government-approved servers and implementing the blocking on those servers).
- deleted 5y ago
  [deleted]
nybble41 5y ago
Unless they wanted to delist an entire country for some reason it's the TLD servers they would need to go after, not the root servers. And yes, they could attempt to go after the TLD itself and not just the ISP's caching recursive resolver. This is why distributed, censorship-resistant domain resolution is so important. The Internet may be distributed and capable of routing around censorship, but the current DNS system is relatively centralized and thus vulnerable to attack.

cesarb 5y ago

I have run my own DNS resolver since that time when VeriSign decided to hijack all unregistered .com and .net domains (https://en.wikipedia.org/wiki/Site_Finder); https://en.wikipedia.org/wiki/Site_Finder); by running your own recursive DNS resolver, it could detect the hijacked responses and turn them back into the correct NXDOMAIN response.

bwoodcock 5y ago

The entire point of this injunction is that it can be applied to people running their own resolvers.