16 ms·
French court orders Google, Cloudflare, Cisco to poison DNS to stop piracy
- TZubiri 2y agoAlternative title: French courts order American DNS providers to block unlicensed sports streaming websites.
- betaby 2y agoWhile refuting the fact that said unlicensed streaming websites are not hosted on American DNS servers.
- gruez 2y ago*American multinationals Your claim would make sense if they had no operations in France, but I highly doubt that's the case. If you operate in those countries, you have to comply with their laws. The fact that your company is incorporated elsewhere is irrelevant.
- TZubiri 2y agoI agree. It would be pretty wild for courts to issue an order for something outside french soil.
- deleted 2y ago[deleted]
- snowwrestler 2y agoOver a decade ago, a ton of tech companies (including Google) coordinated a “blackout the Internet” day of protest against U.S. legislation that would have required them to alter DNS to fight piracy. Interesting that now that France actually does it, they say they will comply. https://en.m.wikipedia.org/wiki/Protests_against_SOPA_and_PIPA https://en.m.wikipedia.org/wiki/Protests_against_SOPA_and_PI...
- metadat 2y agoPiracy is simply Terrible, it's chopping the dear copyright holders off at the knees, they are frequently having to go on food stamps, and it's unclear how they'll continue on. /s Fighting online piracy: First world, or even zeroth world problem. It's not loke the pirates are saying "hmm, should I pay exorbitant rates for this or should I pirate it?" The real competition is alternatives: "should I bother pirating this or just go do some other activity." Bottom line: In most cases it's actually free marketing, and has a net positive effect for the copyright holders. The continual attempts to aggressively clamp down really says a lot about the mentality of the Big Market Forces, *iaa, *aa, and now MS and Elgoog. Even when it's good fertilizer for their perpetual evergreen money tree, they still flip out.
- banish-m4 2y agoIt's all about profit protectionism of the moats around streaming to enforce the arbitrary extraction of gotcha capitalism subscription fees from as many people as possible for as much as possible.
- bognition 2y agoIn the last decade Tech has become part of the establishment. They are one of the dominant controlling forces. The blackout was _not_ about preserving free speech, or any other moral high road. It was purely about control. Tech hadn’t yet cemented their position as a dominant player and didn’t want to cede the control they had. Now that they’ve embedded themselves in the ruling class they don’t care as much because they already have control.
- blackeyeblitzar 2y agoThis is the right line of thinking. My interpretation is slightly different - I think the tech companies have run afoul of various norms when it comes to things like the privacy of customers, anti-trust, taxation, etc. Because they are now reliant on these unethical ways of holding onto economic power or growing their economic power, they need to not get into trouble with governments. This means playing nice with them so that they do not become subject to legislation that will rein them in.
- flawn 2y agoTotal non-sense - just pushes people to use VPN or their own custom DNS which tunnels back to 1.1.1.1 or whatever.
- lm411 2y agoOr just footybite.cc will become footybite1.cc, then footybite2.cc... so on. The people writing these laws are seemingly clueless about the internet. Or perhaps, the lawyers just don't care as they are getting paid.
- brokenmachine 2y agoCould be malicious compliance at any level. Maybe the judge likes to stream football too? Most people don't want effective censorship and effective censorship is much more technically difficult as well as dangerous. I'm happy for them to claim ignorance and implement easily circumventable blocks, rather than go full North Korea.
- leloctai 2y agoHow will users find the new domains? If they can reliability do so then dns is not needed in the first place. If not, then the laws are effective.
- hsbauauvhabzb 2y agoTwitter and Wikipedia as a source to locate the actual dns address worked for the pirate bay back in the day, I assume if nothing else piracy sites would not be afraid to just use raw ip addresses.
- squigz 2y ago"Hey leloctai, what's the new URL for <torrent_site>?"
- lm411 2y agoThere are almost certainly aggregate sites that will share the new domains, messages boards, social media, instant messaging, etc. Word of the new domains will travel very quickly. Hell, they could setup their own public DNS outside of France and suggest users use that. Users already switched from local/ISP DNS to Cloudflare / Google because of the previous law so that is not a big hurdle (ignoring the obvious security problem - many users won't care they just want to watch the game). My point though is that these laws will be very easy to bypass just like most anti piracy laws before it. Note that The Pirate Bay is still up and running.
- steelbrain 2y agoThe title on the website is “Google, Cloudflare & Cisco Will Poison DNS to Stop Piracy Block Circumvention”. Curious why Cloudflare has been singled out in the submission title?
- thejazzman 2y agoThey're the most respected / most surprising?
- dcow 2y agoDoubtful.
- Copenjin 2y agoRespected by who?
- callalex 2y agoRespect might not be the right word, but during their meteoric rise to popularity in the past decade they have consistently shouted “we don’t moderate content, we’re just a dumb pipe, don’t take this up with us take it up with the publisher!” In the past 3 years or so they have repeatedly proven that to be a lie; they weren’t able to have their cake and eat it too. But their old reputation still sticks around amongst people who don’t follow the space that closely.
- Copenjin 2y ago> In the past 3 years or so they have repeatedly proven that to be a lie; they weren’t able to have their cake and eat it too. Yeah, this is what I was referring to, not sure about the reputation but they are still popular, that's for sure.
- anymouse123456 2y agoSame concern here. Also, the phrasing in both, but especially the HN title made me think Cloudflare chose to do something, but it turns out the French court is forcing all of them.
- zzo38computer 2y agoIf it is what public DNS providers do, then they should get a bad reputation and then people should not use them. People can make their own, and/or to just use IP addresses directly (or other methods) if they know what they are from other sources. You can also use the hosts file.
- deleted 2y ago[deleted]
- 0xcde4c3db 2y agoI personally have zero interest in streaming soccer games, but the process involved here does leave me wondering just how resilient 1.1.1.1/9.9.9.9 (which I use with https-dns-proxy because I basically don't trust the business side of my local telco/cable monopolies as far as I can throw them) really are in practice. I'm starting to feel like someone should bring back ORSN and throw some (cryptocurrency-free, old-school cypherpunk) Merkle tree or DHT magic on top of it or something.
- zrobotics 2y agoI mean, there are already issues with 1.1.1.1 where archive.is/.vn/etc sites don't work. I know this is due to that site's admin specifically blocking cloudflare, but it already happens. The real answer is to run your own recursive DNS resolver. It's not for the complete technical novice but it's the same amount of work as setting up pihole and requires the same amount of low-spec hardware. I don't think this is out of reach for anyone who is already using a non-default DNS, since with the reconfigured images available it really isn't too much of a lift.
- machomaster 2y agoCould you please share names/links?
- shadowfiend 2y agoThe only provider here who is stated to have said they will be complying is Google, right? So not only is singling out cloudflare incorrect, the title itself is incorrect. “French court orders Cloudflare, Google, and Cisco to poison DNS to stop piracy block circumvention” is the correct title for the article contents, possibly with an addendum of Google saying it will comply.
- Ayesh 2y agoHilarious how the article mentions the domain names at the end. It's like Google showing links of DMCA-striken lists, so you can easily find out the actual places to pirate.
- applied_heat 2y agoWill read the article now thank you
- ThePowerOfFuet 2y agoThis kind of comment is best left on reddit to keep the signal-to-noise ratio on HN as high as possible. Just hit that upvote button instead. :)
- elicksaur 2y agoWhere do comments calling something Reddit-tier go? >Please don't post comments saying that HN is turning into Reddit. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- BitsOfBeard 2y agoWhat if I'd want to warn users that the list really only encompasses sports related domains? Genuinely want to follow the etiquette here, but I like being useful.
- AnthonyMouse 2y agoStreisand effect.
- hobobaggins 2y agoBut these names aren't resolvable (through compliant resolvers), while the transparency links would be.
- sangnoir 2y ago
- sva_ 2y agoWell that could be considered a pretty useful list
- blackeyeblitzar 2y agoIs there some decentralized anti-censorship technology that can prevent this type of action, where ISPs and DNS providers and other points of centralization are forced to implement things on behalf of other parties (like Canal+ or a government)?
- kmeisthax 2y agoDecentralized and global consensus are contradictory properties, in order to have an otherwise arbitrary ASCII string resolve to a particular machine EVERYWHERE, you need a central authority to say who's who. If you just want to prevent other central authorities (e.g. France) from barging in on the existing central authorities your computer expects to get answers from (e.g. ICANN, Verisign etc) there are plenty of projects for semiuncensoring DNS in a distributed way. But nobody is stopping, say, the US from doing to ICANN or Verisign what France is doing to CloudFlare and Google.
- redox99 2y ago> Decentralized and global consensus are contradictory properties That's literally what blockchain solves. ENS (Ethereum Naming Service) already does this.
- immibis 2y agoThe ethereum block chain is centralized - it may not have a geographical location, but there's still only one of it. In a global partition there become zero of it (only two incorrect fragments), not two of it. Other people have even argued that blockchains are states - as in governments, not as in distributed state replication protocols.
- Dalewyn 2y agoNo. No matter how decentralized something is, ultimately you need to have a server and cables connecting it to the internet located somewhere. That somewhere will be within some legal entity or sovereign's jurisdiction which you must answer to and comply with.
- tialaramex 2y agoOne of the interesting technical questions is how these vendors will choose to reflect the forbidden DNS entries in protocols like DoH where they have a choice. For example a reasonable thing for a DoH server to say when asked a DNS question it has been forbidden to answer truthfully, is HTTP 451 Unavailable for Legal Reasons.
- callalex 2y agoThat would be a layer/protocol violation. The HTTP status codes used in DoH are used to discuss the semantics of the DNS query itself, unrelated to the DNS response. For example an NXDOMAIN response is still a 200, not a 404. Edit: for what it’s worth, Google is doing this the “right” way in the DNS protocol itself, see: https://news.ycombinator.com/item?id=40698650 https://news.ycombinator.com/item?id=40698650
- account42 2y ago> The HTTP status codes used in DoH are used to discuss the semantics of the DNS query itself. And the the response is that the server cannot faithfully answer the DNS query due to legal reasons.
- Jamie9912 2y agoCouldn't Cloudflare route these DNS queries outside the country, and therefore not be subject to French laws?
- jedberg 2y agoThey could, but it would be weird. They use anycast for their DNS, so it will land on the French server before they know what the query is. There isn't really a way to tell a client, "no go to another server with the same IP address". But also they still want all the other French traffic to go to the French servers for performance reasons, so they wouldn't want to send all French traffic outside the country.
- bastien2 2y agoA great example of why you should be running your own validating recursor instead of relying on a third party
- OptionOfT 2y agoCan you elaborate on the validating part?
- betaby 2y agohttps://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en https://www.icann.org/resources/pages/dnssec-what-is-it-why-... And how to enable it on `unbound` https://www.howtoforge.com/how-to-set-up-local-dns-with-unbound-on-debian/ https://www.howtoforge.com/how-to-set-up-local-dns-with-unbo...
- Aissen 2y agoThe problem is that if everyone does that, DNS no longer scales; or it should be done smartly with only recursing censored answers. And then it will escalate with IP-level blocking of root servers or NS servers of censored websites.
- belorn 2y agoIt is times like this that I recommend technically inclined people to try setting up your own dns resolver and see how minimal impact a few/handful of milliseconds on first access has on the internet experience. Practically all popular domains also uses some form of anycast network, so the benefit of a single large shared resolver that caches the dns answers has steadily decreased each year. Just make sure its not configured to be a public resolver, and only allow local network or whitelisted addresses.
- josephcsible 2y agoSetting up your own recursive DNS resolver to circumvent ISP blocks is pointless unless you do so on a VPS or something, because otherwise, your ISP will just hijack the recursive queries it makes. And DNSSEC doesn't help if the ISP just wants to block you from learning the real IP.
- hsbauauvhabzb 2y agoI’ve heard this before. Is there a way to reliably detect if this is occurring or case studies of where this has occurred? Edit: I assume dns over https prevents this also, right?
- AnthonyMouse 2y agoDNSSEC would reveal that it's happening straight away, but that doesn't get you the IP address. Of course, as mentioned putting your recursive DNS server on a cheap VPS somewhere that doesn't hack your connection would.
- josephcsible 2y agoYes, DoH prevents that, unless the DoH provider is in on it too, which most of the major ones are now, as this article is about.
- nucleardog 2y agoThere are lots of providers that aren’t CloudFlare/Google/etc: https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-available-servers https://github.com/curl/curl/wiki/DNS-over-HTTPS#publicly-av... (There’s lots of smaller providers, but lots operated by governments, ccTLD administrators, and other major organizations) I only bring this up because the idea that the major providers “are” the internet is the only reason this is a possible and a problem in the first place.
- geor9e 2y agohttps://www.mic.com/articles/85987/turkish-protesters-are-spray-painting-8-8-8-8-and-8-8-4-4-on-walls-here-s-what-it-means https://www.mic.com/articles/85987/turkish-protesters-are-sp... Repressive governments have a history of legal orders telling Google to block protestors from accessing twitter.com but Google always refuses to comply. So their new policy of complying isn't about legality. France is a big market. Perhaps it's about money.
- jsnell 2y agoUh, there's nothing in your link about a government ordering Google to block Twitter? Since you say this is a common occurence, I'm guessing it'll be easy for you to find a source that actually supports your claim.
- can16358p 2y agoI think the main point is that it's trivial for people to circumvent the DNS level block by simply finding new DNS servers (in this case something other than local ISPs, Google, CF etc... still many out there) by asking others or simple googling here and there, and in extreme cases, at a physical level as in the article.
- DannyBee 2y agoFrance is not a big market for Google. The entire ad revenue market (desktop + mobile + social + ....) in France, in 2023, was 5.8 billion dollars (The spread in public sources data seems to be 5.0billion-6.2 billion, so i just took the high side) 1. Google made over $240 billion in ad revenue in 2023, so even if it had 100% of all ads revenue in France, France would only account for 2.5% of Google's revenue. 2. However, Google's share in France is nowhere close to 100%. Search + Display overall is currently sitting at 20-25% of the french ad revenue above (same sources). Let's assume Google has 100% market share in France in those areas. Then France would account for about 1.25 billion dollars of revenue for google, or about 0.5 percent of Google's revenue. Which is not a lot. But it's still something. Or it would be, except: 3. France has fined Google 224 million so far in 2024. Google's margins are around 25%. So that 1.25 billion of revenue produces around 312.5 million of profit. Maybe less Of which they've been fined 224 million :) If Google gets fined in France again this year, it would probably be operating at a loss.
- hsbauauvhabzb 2y agoI’ve always been curious why dns is a go-to for oppressing unwanted websites. Is it truly difficult to block at an IP level? There would be collateral damage in doing so, but it wouldn’t take long for most VPS providers to dump piracy sites if the alternate is their entire network block being dropped.
- OptionOfT 2y agoA good amount of these websites are proxied by Cloudflare, so you're connecting to CF and CF connects to the website. And many websites use CF, so if you were to block a CF IP, you'd block a whole bunch of websites.
- derekp7 2y agoIn that case, what makes Cloudflare immune to court ordered blocks?
- AnthonyMouse 2y agoYou've identified exactly the problem. They'd be blocking thousands of unrelated innocent websites. Also, changing your IP address is really easy.
- hsbauauvhabzb 2y agoThat’s something cloudflare doesn’t want either. They wouldn’t even need to do it, just threatening to would have a financial impact on cf.
- AnthonyMouse 2y agoMore likely the opposite. A site which is legal in the US or elsewhere but not in the EU would then have fewer options for finding a convenient host, even though it's perfectly legal in the country where it actually operates, because the EU would be exerting extrajurisdictional pressure on hosts by blocking all of their other customers. Those customers would then prefer a host large enough to resist that pressure, which is Cloudflare, because a country that tried to block them would break the internet in their country. And then Cloudflare would improve their reputation among customers by resisting an attempt to DoS a site which is legal where it operates. Meanwhile it would do nothing to put the site offline regardless because there are more hosting companies than there are atoms in the universe and many of them serve primarily local clientele and wouldn't really care if they got blocked in a country where their customers aren't. They'd have to be blocking the majority of the total IPv4 address space before the site ran out of somewhere to move.
- 1vuio0pswjnm7 2y ago"A French court has ordered Google, Cloudflare, and Cisco to poison their DNS resolvers to prevent circumvention of blocking measures, targeting around 117 pirate sports streaming domains." Most if not all of these domains probably use Cloudflare as their authoritative DNS servers because they are using Cloudflare CDN. Why not just ask Cloudflare to "poison" those RRs. No need to issue orders to a selection of cache operators.
- deleted 2y ago[deleted]
- musicale 2y ago> rightsholders can demand “all proportionate measures likely to prevent or put an end to this infringement, against any person likely to contribute to remedying it.” Rightsholder: "Let's see, life insurance payouts are €1M and we are losing at least €50M to these sites, so..."
- TZubiri 2y agoThis looks like such a non issue to be honest. Government branches should have technical and legal capabilities to block domestic and foreign hosts. Legitimate foreign service providers, should either comply with local government, cease operations in that country, or be prepared for war.
- josephcsible 2y agoWouldn't China's GFW be considered a good thing by that argument?
- TZubiri 2y agoNot a fan of categorizing stuff as good or bad. But yes, countries should have control over their borders, both physical and digital.
- mlhpdx 2y agoI’d just add the IPs to my LMHOSTS file (Windows) if I really wanted to watch sports badly enough. I mean, I was doing that back in the day for local development anyway.
- mrbluecoat 2y agoI'm sure that will work. (too bad HN can't load my sarcasm font)
- throwaway290232 2y ago[dead]
- deleted 2y ago[deleted]
- m3kw9 2y agoOnly in France?
- HlessClaudesman 2y agoA new law requires plant shops to stop selling poisonous plants. If people really want to grow these plants they will find a way. Nature still exists.
- gostsamo 2y agoIt is funny how the article lists the blocked websites and what content could be found there. Barbara strikes again.
- pabs3 2y agoWonder why they don't just go after the DNS registrars for these domains, or the DNS root servers.
- account42 2y agoBecause those are not under the French government's jurisdiction unlike responses served to French users. Many of the used TLDs are even explicitly under other countries' governance.
- kgeist 2y agoI wonder if it's possible to just use Yandex DNS. Russia won't comply obviously.
- Shank 2y agoWith this DNS provider, I would be equally if not more worried about what the Russian government forces Yandex to block or censor.
- popcalc 2y agoJust add 1.1.1.1 as the second dns server
- adam_hn 2y agoAlso, Yandex search is the best for certain search queries that google and American companies want/forced to remove.
- hgyjnbdet 2y agoSo if you're using something like a pihole, and provided you're not using any of the mentioned companies, your go to go?
- gruez 2y agoAFAIK pihole still relies on an external recursive resolver (at least by default), so you'd still be subject to whatever blocks your ISP/cloudflare/google imposes.
- MenhirMike 2y agoSo, with 1.1.1.1 and 8.8.8.8 being useless then, what DNS Server is recommended going forward?
- santiagobasulto 2y agoThis is a great opportunity for a VPN provider to come up with an extra product being a paid DNS resolver.
- aryonoco 2y agoMullvad has it and it's not even paid, it's free.
- vinay_ys 2y agoThere are many such local laws limitations that big techs have to bow to (that smaller obscure companies choose not to). For example, Google won't offer its VPN service as part of Google One in India. Whereas, proton/mullvad works just fine.
- egberts1 2y agoThat's easy to circumvent. A VPS host running DNS resolver and point your boxes to it. You're welcome.
- egberts1 2y agoUnless France starts blocking DNS port 53/udp and 53/tcp and start whitelisting DNS servers ... :-/
- zokier 2y ago[flagged]
- machomaster 2y agoRampant? Read the article before commenting, they are talking about 800 people in the whole of France. It's clearly not about severity, but about control. They would try the overreach even if there is no damage to be found (like using ridiculous "this is the money we lost" calculations).
- gruez 2y ago>Rampant? Read the article before commenting, they are talking about 800 people in the whole of France. 800 is the figure given by google's attorney for people that would be affected by the block enforced by public DNS servers, not the total amount of "rampant piracy" that's going on.
- immibis 2y agoLogical extensions of this principle: * Domestic abuse is the victim's fault because they shouldn't have made their partner angry. * The Chinese GFW is the fault of the people who criticized the government. They shouldn't criticize the government. * Israel indiscriminately bombing Gaza is the fault of the Gazans who fought back the last time Israel did that. * The Holocaust is the Jews' fault for not fleeing the country sooner. I don't think it's a good principle.
- gruez 2y ago>* Domestic abuse is the victim's fault because they shouldn't have made their partner angry. * The Chinese GFW is the fault of the people who criticized the government. They shouldn't criticize the government. * Israel indiscriminately bombing Gaza is the fault of the Gazans who fought back the last time Israel did that. * The Holocaust is the Jews' fault for not fleeing the country sooner. Except in all those cases, you can vaguely make the case that the "victims" were in the right (eg. the right to be not physically assaulted). It's far more questionable to claim that people have the right to free live sports streaming.
- amarcheschi 2y agoIn Italy we gave rights to a private company to tell all ISPs what sites should be blocked by ip. Eventually, other websites go down when some cloudflare ip gets blocked
- wdb 2y agoIf you need to poison the DNS by court order. Can you also just poison the requestees DNS entries? E.g. Canal+ own websites?
- struant 2y agoThat is really good point. The court is basically giving them permission to do this, by asking them to not have net neutrality.
- gruez 2y agoChildishness aside, this is a dumb idea because it's going to piss off more users than appease. Most don't care about the struggle for internet freedom or whatever, and just want their sites to work. For them blocking legitimate sites a sign that their ISP is broken, especially when their friends/colleges report that it's working fine on their connections. Moreover blocking illegal streaming sites is court sanctioned whereas blocking the plaintiff's sites is not, and likely expose them to getting sued for tortious interference or similar.
- mhitza 2y agoNo mention in dns0.eu, which is what I use and also hosted in the EU.
- JackSlateur 2y agoTechnically, google did it right (using the "censored" error code: https://datatracker.ietf.org/doc/html/rfc8914#name-extended-dns-error-code-16- https://datatracker.ietf.org/doc/html/rfc8914#name-extended-...): root@jack:~# dig footybite.cc @8.8.8.8 ; <<>> DiG 9.18.19-1~deb12u1-Debian <<>> footybite.cc @8.8.8.8 ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 14528 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ; EDE: 16 (Censored): (The requested domain is on a court ordered copyright piracy blocklist for FR (ISO country code). To learn more about this specific removal, please visit https://lumendatabase.org/notices/41606068.) ;; QUESTION SECTION: ;footybite.cc. IN A ;; Query time: 7 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) (UDP) ;; WHEN: Sun Jun 16 19:24:29 CEST 2024 ;; MSG SIZE rcvd: 243
- account42 2y agoTechnically interesting but unless browsers start showing the error to the user about 0% of affected users will benefit from this.
- collaborative 2y agoTheft is theft, don't matter if it's irl or online. As a developer who periodically witnesses users spending hours trying to circumvent 1 dollar payments I think that the time has come for the piracy culture to end. And I used to do piracy too
- Anamon 2y agoCopyright infringement is not theft -- false comparison. Also, have you considered how likely the people who are trying to get around your payment would be to pay up if they didn't find a way? If what you say about how long they try is true, I'd say the chance is extremely close to 0%. That's the dirty secret of the anti-piracy campaigns of rightsholders. The "lost sales" narrative is a load of made-up horseradish, and they know it.
- nektro 2y agoabsolutely appalling on France here
- smsm42 2y agoSo, looks like there's a market for non-censoring public DNS providers. Any recommended providers?