16 ms·
French Gov Wants to Inject Domain Blocking Lists Directly into Web Browsers
- friend_and_foe 3y agoNo mention of the fact that it cannot be done with open source software. France is going to just wind up geoblocked for all browser websites.
- DeathArrow 3y agoIf they catch you using an illegal browser will you go to jail?
- hulitu 3y agoNo, but you will be a criminal.
- csdvrx 3y agoDon't they already consider you a criminal if you use an ad-blocker or Linux?
- logicprog 3y agoOr especially Signal and Tor. But only if you're a leftist! Because leftists must of course be using those things to plot terrorism. Being a leftist while using privacy tech was a core part of the reasoning for the cops arresting those people.
- decremental 3y ago[dead]
- BasedAnon 3y agoconsidering they're the same people who tortured my family i don't really put any weight in who they consider a 'criminal'
- still_grokking 3y agoSo nothing new. To the state all hackers (in the original meaning of this word) have been criminals since forever. Knowledge and skill are very dangerous traits, you know? In Germany we have even dedicated anti-hacker legislation. Hacking stuff is indeed illegal. You may end up in jail for "hacking"… That's likely "the freedom" they are always talking here about in the west. /s
- andsoitis 3y ago> In Germany we have even dedicated anti-hacker legislation. Where can I read it (I grok German)
- still_grokking 3y agohttps://netzpolitik.org/2014/hackertools-im-it-sicherheitsgesetz/ https://netzpolitik.org/2014/hackertools-im-it-sicherheitsge... https://netzpolitik.org/2013/angriffe-auf-informationssysteme-eu-parlament-bringt-richtlinie-zu-europaweitem-hackerparagraf-auf-den-weg/ https://netzpolitik.org/2013/angriffe-auf-informationssystem... (Also the links there.) Or a more "official" statement (as the German Wikipedia is mostly in the hands of state authorities), with some groundless relativization: https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hens_und_Abfangens_von_Daten https://de.wikipedia.org/wiki/Vorbereiten_des_Aussp%C3%A4hen... All "dual use" tools (like a simple port scanner!) can bring you into jail. That's a fact. The law doesn't have any exceptions for "friendly use"… (No matter what some "experts" cited on Wikipedia may say. That's just the usual German Wikipedia blow smoke…)
- inkyoto 3y agoAnd then there are always the good ol' pals that go by names of telnet and netcat: telnet www.example.com 80 GET /article.html Instant felony charges, huh?
- henearkr 3y agoI don't really see the problem as anybody can use an open source browser compiled without those, assuming there is any kind of benefit to access those blocked domains, which is doubtful. The general population will not use such custom-compiled browsers, which fulfills the aim of security without having to threat user with any kind of punishment.
- idiotsecant 3y agoThe natural next step is outlawing dangerous extremist browsers that fail to implement The List. Is there some reason you don't want to protect children and fight terrorism? What do you have to hide?!?
- henearkr 3y agoI don't think, and I hope not, that it is a natural step. Imho the law is design to prevent unaware users to harm themselves.
- Etheryte 3y agoIt's a complete misnomer to try and frame this as a security issue, it's not about security, it's censorship. The government has no business saying what websites you can read just as the government has no business saying which books you can read or which newspapers.
- hulitu 3y ago> The government has no business saying what websites you can read just as the government has no business saying which books you can read or which newspapers. This is, unfortunately, not true since some years.
- martin8412 3y agoThat was never true.
- chrisco255 3y ago
- gmerc 3y agolaughs in curl
- testacc9367 3y agoVery liberal! Chapeau!
- supriyo-biswas 3y agoIn recent times the EU member states seem to take many steps backwards in terms of civil rights and general freedoms, including the proposed Chatcontrol legislation, the one above, and many others. Furthermore, because the “west” is typically seen as better than the “east”, such a law, if passed would be adopted rather quickly by countries outside the EU member states. This has happened with the NetzDG social media laws in Germany and similar onerous laws being adopted in other countries; EFF has lots of articles regarding it. Specific to the subject matter of this article, even China is doing a better job by mostly censoring at the ISP level and investing in entropy analysis of network streams.
- rektide 3y agoThe precedent here is that any of the 200 nations of the world now can arbitrarily tell browsers what to do. It's forcing the browser to be non-neutral to content & sites, forcing it to become a regulatory agent. Right now it also sounds like thr government is basically sending letters. How does a browser maker know what letters to trust & which are outright bogus or someone in thr government overstepping their bounds? What is the expected maintenance burden we are putting on folks making browsers? Are there any limits to this rule? What happens if elinks browser or w3m doesn't update itself? How will the government figure out who to send updates to?
- supriyo-biswas 3y agoIt is likely that using an "illegal" browser would be a thing? What, you use this thing called "curl"? Must be an illegal tool. I've talked a bit too much about Stallman's "The Right to Read", but this paragraph seems prescient, except that the "root password" he talks about would be some form of hardware-assisted cryptographic attestation today. > It was also possible to bypass the copyright monitors by installing a modified system kernel. Dan would eventually find out about the free kernels, even entire free operating systems, that had existed around the turn of the century. But not only were they illegal, like debuggers—you could not install one if you had one, without knowing your computer's root password. And neither the FBI nor Microsoft Support would tell you that.
- sylware 3y agoI am already sueing the french government for not enforcing interop with noscript/basic (x)html browsers, now that... Well, I am quite suspicious.
- eastbound 3y agoOk, so this is why browsers pushed so hard for DNS-over-HTTPS! It makes it inevitably the single-point-of-censorship. And it also aligns very well between Mozilla’s views on other societal issues and Macron’s views on oppositions.
- detourdog 3y agoYes, the double whammy is working against self-signed certificates which I see as great for small groups.
- mschuster91 3y ago> Ok, so this is why browsers pushed so hard for DNS-over-HTTPS! It makes it inevitably the single-point-of-censorship. DoH actually makes it harder for the government to censor domains as the browsers don't use the ISP-provided DNS infrastructure any more, which is why the French governments wants to force browser vendors to do it instead.
- gsich 3y agoIt does not. As the "big" DNS providers can also be forced to comply. Example, although it's the usual copyright mafia stuff: https://www.quad9.net/news/blog/an-update-to-the-quad9-and-sony-music-german-court-injunction-august-2022/ https://www.quad9.net/news/blog/an-update-to-the-quad9-and-s...
- deleted 3y ago[deleted]
- pepa65 3y agoIsn't that exactly the point that PC was making? That it HAD to happen in the browser now??
- mschuster91 3y agoBrowsers didn't push for DoH because they wanted to be the target for censorship demands, they pushed because DNS manipulation by everyone from governments and ISPs to a ton of middlebox vendors got out of hand - DNS ossified particularly because of the latter - and on top of that because DNS was cleartext and leaked metadata to everyone able to install a sniffer along the path.
- anthk 3y agoGood luck on doing that with Lynx. If any, I'd switch into Gopher/Gemini/IRC/NNTP forever.
- pavlov 3y agoI don’t imagine a lot of child porn browsing happens on Lynx. In practice a government only needs to mandate their blocklist with Google, Apple, Microsoft and Mozilla. The first three are cloud and OS vendors, so they already collaborate with Western governments on many kinds of content filtering and monitoring projects. Only Mozilla has any sort of independence in the browser market.
- zapdrive 3y agoWhat do you expect from a government that has criminalised DNA based paternity tests done without the consent of the mom. Yes, if you have doubts about your wife's loyalty and want to silently do a DNA test with your supposed child to make sure you are the actual father, you need your wife's consent. If you do it without her consent, you will go to jail. I know it's off topic, but that's the first thing that comes to my mind whenever i hear the word "France".
- cynicalsecurity 3y agoCan you make a DNA test in another country?
- anthk 3y agoReaching Spain or Germany would be a breeze for any French.
- Duwensatzaj 3y agoAlso illegal but not uncommon. To clarify, French judges can order paternity tests as part of a hearing. Germany has restrictions on paternity tests as well.
- dopidopHN 3y agoThat the worst you can think about France? Well thanks, that’s a cute one.
- logicprog 3y ago> Yes, if you have doubts about your wife's loyalty and want to silently do a DNA test with your supposed child to make sure you are the actual father, you need your wife's consent. If you do it without her consent, you will go to jail. Uh yeah, because that's extremely creepy and fucked up?
- orwin 3y agoNote: France might be the most authoritarian country of the western world (depending if you count Eastern Europe, Turkey or Israel in the western world). Not disputing that. However, this seems misleading [0]. To me, it's clear that what's illegal are private genetic tests. It's a law from 97 also. And if you have doubts, you have to go see a judge: ""Si vous saisissez un juge pour établir ou contester un lien de filiation, vous pouvez lui demander un test de paternité. Le test peut être refusé par le juge uniquement pour un motif légitime. Vous n'avez pas à réunir des preuves ou indices de la paternité pour obtenir le test."" [0] https://www.service-public.fr/particuliers/vosdroits/F14042 https://www.service-public.fr/particuliers/vosdroits/F14042
- jacquesm 3y agoClient side security... I don't think that will work at all.
- Etheryte 3y agoWhile you're not wrong, it isn't useful to frame this as a technical discussion. We don't want censorship, period, no ifs ands or buts.
- jacquesm 3y agoAgreed, but if they are going to implement censorship I'm all for doing it in an incompetent way. Meanwhile, this proposal will likely not fly because it's going to be impossible to implement, either imperfectly or even at all. A bigger problem is if they catch on to the fact that France is dependent on a handful of large ISPs and that they can do this far more effectively at the ISP level.
- hashstring 3y ago[dead]
- houseatrielah 3y agoIts a form of de-platforming, and de-platforming is effective (not 100% effective ofc; "build your own platform" becomes "compile your own browser"); apologies to John Gilmore.
- contravariant 3y agoIf it's just a about adding the means then uBlock origin fits the bill. I can't make heads or tails of the translated piece of law though so I can only assume that giving people to ability to exercise control over what they see or don't see online wasn't the intended purpose.
- geraldyo 3y agoIsn't this something that technically already exists? It seems to me the government is demanding thst browsers have that capability; not that the companies would have to use that feature. But (1) it may actually not be technically possible right now? Or (2) the wording is confusing enough that it is essentially forcing the use, not just "having the ability"
- Avamander 3y agoThey can run their own DNS servers, publish the lists, but it can't be the browsers enforcing it. Otherwise it's an idiotic path towards jailbreaking browsers.
- detourdog 3y agoTo me the browser is the wrong vehicle for this. How can we have a completed unregulated internet and just clean up the mess in a browser. To base regulation on something as amorphic as a web browser…. Demonstrates illiteracy of the subject matter.
- beardyw 3y agoSo the French government create a list of the sites you shouldn't visit. Isn't this going to be the Streisand effect at a national level.
- jongjong 3y agoIt depends on the number of sites that are on this list. Probably too many for people to be able to focus on any specific one.
- flir 3y agoThe list, once published, can be segmented, annotated, etc. Actually sounds quite handy (he said facetiously).
- jongjong 3y agoThe way that kind of censorship works is that they will block 1 legit site that they don't like for every 100 actual scam sites which 'deserve' to be blocked. You won't even be able to tell which is which. It will literally look like a long list of spam sites and everyone will thank the government for doing a great job protecting them as they always do. Whenever western governments do truly evil stuff, there is almost always a very good cover narrative.
- LelouBil 3y agoLook at my comment : https://news.ycombinator.com/item?id=36533118 https://news.ycombinator.com/item?id=36533118 Basically for now the only thing that can put a site on this list is if the website is harming their visitors.
- danogentili 3y agoSuch lists already exist, for example in Italy there's a number of official government blocklists that the ISPs are already obligated by law to apply using their DNS servers and soon at the IP level, once the latest law is implemented. In typical Italian style, the blocklists are actually published as a set of HTML articles on various government websites, that must be scraped and parsed by the ISPs using toolkits like https://github.com/mphilosopher/censura https://github.com/mphilosopher/censura. The latest proposal now additionally requires acknowledgement through PEC, i.e. domains to block will be sent by rightholders through certified emails to ISPs, and upon processing them ISPs *must* send an acknowledgment in the form of another certified email within 30 minutes, or else sanctions will follow. This latest proposal has rightfully caused an uproar of the ISPs in groups like itnog (https://t.me/IT_NOG/106605/106606 https://t.me/IT_NOG/106605/106606), considering that most PEC providers only offer a few GBs of space, there's already a high risk of ack emails being lost (with subsequent sanctions), not to mention that the concept of automating domain distribution and acknowledgment using email instead of a simple JSON-RPC API is ridiculous, but that's what you get when bureaucrats make technical proposals :)
- deleted 3y ago[deleted]
- jongjong 3y agoSurely everyone knows this is not to protect people from fraud. It's to protect politicians and other public figures from the repercussions of being widely hated. The solution to this problem is simply to stop interfering with people's lives in a negative way. If you don't interfere with people's lives at all, they will have no reason to hate you and this approach costs nothing.
- LelouBil 3y agoLook at my comment : https://news.ycombinator.com/item?id=36533118 https://news.ycombinator.com/item?id=36533118 Basically (at the current state of this law project) the criteria for being put on this Blocklist is for website to be actually doing fraud.
- jongjong 3y agoIMO, it's not the government's job to protect people from their own failure to identify a fraud. The government cannot protect people from fraud any more than it can protect them from going bankrupt due to poor management of their personal finances. It's a lesson they have to learn on their own. Also, I simply won't believe that narrative while gambling is still legal and while the government itself uses the monetary system to run the economy like a game of musical chairs.
- Kbelicius 3y ago> IMO, it's not the government's job to protect people from their own failure to identify a fraud. I really don't understand this stance. If it isn't a governments job to protect people from fraud, and people should learn on their own, why stop there? Why have any food standards, learn to check every item of food you consume? Why protect from violence when people should just learn where not to go, what not to say...
- jongjong 3y agoI also agree with this. Regulations don't work and tend to serve the interests of incumbents who can afford to work around them. I would prefer it if governments would get rid of all regulations entirely and, instead, they would remove the concept of 'limited liability' entities - That way if a company harms people, the directors could be pursued legally and could potentially even be held criminally liable. IMO, the most effective form of regulation is self-regulation; it needs to start in the mind of the person who is making product decisions (they are best placed to understand their product and their customers after all) - The way to do that is by making sure that people are held fully responsible for any harm that they cause. Even if someone is partially responsible for causing harm, they need to be held liable. Note that this does not require the government to create new laws; it merely requires that the government remove old ineffective laws which protect people from being held fully liable for their actions. This level of liability will make it impossible for corporations to exist... But that would be a good thing. How many times have corporations like JP Morgan been fined for violating regulations? The fact is that they are simply not equipped to be responsible for their own actions at the scale that they're operating. The modern idea of governments trying to prevent harm before it happens instead of merely punishing it after the fact is deeply flawed. The best way to prevent crime is by punishing it relentlessly and making an example out of the perpetrators. It has always worked that way. Let producers know that they're responsible, that they're the ones taking the risk and that the penalties are harsh. What modern governments are doing with regulations is essentially taking responsibility away from the people who are causing harm. Then instead of fostering a mindset of "We don't want to put sucralose in our product because we don't want to risk going to jail or being sued if some of our customers get cancer and a causal link is established in the future", we foster a mindset of "Look, sucralose is legal, if we put sucralose in our products within the allowed guidelines and people get cancer, it's the government's fault because they said it was safe."
- LelouBil 3y agoI speak french, and I read the mentioned article of the law project and the part referenced in other laws, here are what I find useful to juge it : Basically, if a website is deemed be illegal, a notification is sent to browser makers and to the website owner. The website owner has 5 days to answer and defend themselves. Browser makers are forced (as a cautionary measure) to make the browser display a warning upon browsing this website for 7 days following the initial notification. The warning should detail the danger of visiting this website. If at any point the investigation deems the website is not doing illegal stuff, browser makers are sent another notification telling them to remove the warning. If the investigation deems the website to be illegal, browser makers will have to block access to this website for 6 months. If at any point the website is not doing illegal stuff anymore, the block will be removed. Where I used "illegal" here I actually mean that the website is doing one of these things (explicitly written in the law/referenced laws): - Identity Theft - Illegally collecting personal data or using it in a illegal way - Accessing or maintaining access to a restricted system (basically hacking) - Collecting, giving access, or making tools that allow fraudulent payment. If the owner of the website starts a complaint and starts defending themselves, all blocks are suspended for the duration of the procedure. What I think of it : It seems to be actually well intentioned given the restricted aim of what is an "illegal" website, it's not about piracy or anything. What is written in the law is really and exactly about websites that harm their users. The only problem would be if this law gets more edits and starts including other types of infractions
- guilamu 3y ago"The only problem would be if this law gets more edits and starts including other types of infractions " This. Has we've seen so many times, this is a slipery slope and bad things will happen. Just these last few months, the gov is using antiterrorist laws to monitor / follow and jail environmental activist.
- still_grokking 3y agoHow do they plan to make the software vendors comply? I don't think my Firefox build by Debian would give a shit about any such list. And than, what? How could anybody even detect that I'm using an "illegal web browser"?
- hinata08 3y agoto complete the picture, in the previous week alone : - a court found that is was illegal to have covered a feminist book shop in during the visit of a minister, to hide content about cases he was involved in. [1] - the agreement of one of the largest anti-corruption NGO was cancelled, making it more difficult for them to bring corruption cases to court. [2] they had their nose in what is becoming a state scandal (Affaire Kohler) - an ecologist NGO was disbanded by the same minister involved in 1 [3] - and you must have seen the guy who was shot dead by the police. The police then made up a story that was debunked by a witness on social media. [4] It follows months of protests being forbidden using anti-terrorism laws [5], and parliament being bypassed so hard that the Council of Europe raised questions about democracy [6] Telegram was also blocked during a whole day, and connection attempts were logged, all of that "by accident" [7] So if the current government wants a law to be applied, like web censoring, they will explore any means for that. ------------------------------------------------------------------- these links are in french, you could use google translate ------------------------------------------------------------------- [1] https://france3-regions.francetvinfo.fr/provence-alpes-cote-d-azur/alpes-maritimes/nice/une-librairie-feministe-de-nice-fait-condamner-l-etat-pour-atteinte-a-la-liberte-d-expression-2803343.html https://france3-regions.francetvinfo.fr/provence-alpes-cote-... [2] https://newsinfrance.com/anticor-loses-the-license-that-allows-it-to-take-legal-action/ https://newsinfrance.com/anticor-loses-the-license-that-allo... [3] https://www.liberation.fr/politique/soulevements-de-la-terre-le-gouvernement-acte-la-dissolution-en-conseil-des-ministres-20230621_NRRHHOYS6ZCOVFB5KXQPNXU4ZA/ https://www.liberation.fr/politique/soulevements-de-la-terre... [4] https://www.bbc.com/news/live/world-europe-66049895 https://www.bbc.com/news/live/world-europe-66049895 [5] https://www.huffingtonpost.fr/politique/article/l-interdiction-des-casserolades-dans-le-viseur-du-ministere-de-l-interieur_217236.html https://www.huffingtonpost.fr/politique/article/l-interdicti... [6] https://www.venice.coe.int/webforms/documents/?pdf=CDL-AD(2023)024-e https://www.venice.coe.int/webforms/documents/?pdf=CDL-AD(20... [7] https://www.lemonde.fr/pixels/article/2023/05/13/les-adresses-telegram-bloquees-en-france-par-erreur_6173242_4408996.html https://www.lemonde.fr/pixels/article/2023/05/13/les-adresse...
- andrewstuart 3y agoGovernmental oppressive control of the web always starts as “a way to protect the children”, and before you know it web browsers are forced to stop citizens visiting pornhub or casino sites.
- slooonz 3y agoOr just sci-hub.
- fguerraz 3y ago> Of course, governments have a responsibility to protect all Absolutely not. Government's job is to enforce laws and protect the national territory. But my personal protection is my sole responsibility. If someone endangers me by not respecting the highway code, the police needs to stop them, it's their job. But do I agree to have the government mandate that I wear a safety belt? No. If I'm stupid enough to not wear it, I'm fine to not be entitled to claim damages in case of accident. Of course you can make an argument that not wearing my safety belt has a cost to society (or not having that domain suppression list) and that therefore it should be banned. And I hear the argument. But in the end it comes down to what do you want the government's role to be: protect your freedom or protect you from your own stupidity? The latter really scares me.
- flir 3y agoThat's a viewpoint that leads you to lab testing all your food before eating it.
- fguerraz 3y agoyou're missing the point. I'm happy to have laws that prevents causing harm to other people (the highway code for example, or for the food industry to have a responsibility to not poison their customers). But I'm not happy to have laws that stop me from growing my own food, without having to lab-test it, if I don't intend to sell it.
- flir 3y ago> my personal protection is my sole responsibility Honestly, that sounds a lot like caveat emptor me. I think we have to assume I didn't understand your intent.
- Kbelicius 3y ago> But my personal protection is my sole responsibility. Are you also against private property?
- detourdog 3y agoI'm for all sorts of government regulations. Most around social services. The EU makes me feel like my crazy uncles ranting about the EU. Does anyone think that the EU could regulate themselves into a second tier market for tech products(they get the same products but not on the same schedule. The release is based on a second level of development to meet the EU specifications.) I could concede that all of their goals are worthy but I feel like I have a Project Manager defining tech solutions.
- gumby 3y agoAs the article points out we already have such systems, like google's "safe browsing" that most people use without thinking about it. As long as these things can easily be bypassed by someone who wants to do so, it's not so bad in principle. Speaking of "in principle": in principle a government list is more accountable than a list from some private corporation. I'm not advocating this vchip proposal, just pointing out more nuance than appears in most of these comments.
- deepserket 3y agoAnother system is UBlock Origin, I bet almost anyone here is using it. https://github.com/gorhill/uBlock/wiki/Badware-risks https://github.com/gorhill/uBlock/wiki/Badware-risks
- account42 3y agoIf anything, Google's unaccountable "safe" browsing list is an example of why this a really bad idea even in principle.
- gumby 3y agoAt least you can disable it (I do). But indeed -- how do we know the government isn't already compelling Google to add sites to the list?
- Kaijosan 3y ago[dead]