21 ms·

Malaysia started mandating ISPs to redirect DNS queries to local servers

• throwaway48476 2y ago
  Does anyone host zone files for local dns?
• Shank 2y ago
  > Websites are only blocked when they are found to host malicious content, such as copyright infringements, online gambling, or pornography So I guess pornography is illegal in Malaysia? I guess this is a great time for Malaysian users to switch to DoH. Edit: Yes. Wikipedia: > Pornography is illegal in Malaysia with fines of up to RM10,000 for owning or sharing pornographic materials
  • CAP_NET_ADMIN 2y ago
    Countries always fighting the most important battles :eyeroll:
    • stackghost 2y ago
      Porn is just the justification. It's easy to find something repugnant on whatever streaming video site and then start with the "protect the children" nonsense. The real issue is always control.
    • RandomThoughts3 2y ago
      Backward countries being backward. The main flaw of modern liberal societies is that parts of them have stopped believing that liberalism is indeed progress. All hail the moral police and long live cultural relativism or whatever its currently trendy post-structural reconstruction is.
      • yarg 2y ago
        It doesn't help that the term 'liberal' has had its meaning so co-opted that it now refers to people who reject freedom of speech and belief.
        • CaptainFever 2y ago
          True, though I would say that is leftism. Leftists actually hate liberals and use it as a slur, believe it or not.
          • BlueTemplar 2y ago
            While they often go together, economic liberalism shouldn't be confused with social liberalism.
  • seungwoolee518 2y ago
    My country (Korea, South) is also prohibited to get pornography service. (And they also terminate TLS using TLS HELLO) So, DoH should be work fine for now, but they'll (gov.) terminate HTTPS (or TLS) connection ASAP.
    • christophilus 2y ago
      The only hotel I remember from my visit to South Korea (20 years ago) had a whole bookcase full of porno DVDs in the lobby. Were they just breaking the law in plain view?
      • seungwoolee518 2y ago
        There are some movies out there (but it's not a porn.) as Ero(tic)-Movie. It's legal, but it's not a porn.
        • kijin 2y ago
          There are conditions a producer must meet to make their wares legal. Same as why a lot of Japanese people seem to have pixelated genitals. ;)
      • csomar 2y ago
        People break the law all the time, it's up to the government to enforce it and many times the government is unable to do that. See here in the case of Malaysia, it's not that Porn was legal, it's that they weren't competent enough to restrict it or know about DNS things.
        • deleted 2y ago
          [deleted]
    • 38 2y ago
      You can spoof the TLS Hello since at least 2021
    • HeatrayEnjoyer 2y ago
  • harrygeez 2y ago
    I'm Malaysian. They even messed up DoH for the popular DNS providers like Google and Cloudflare. I think they are routing 1.1.1.1 to their own DNS, so when you try to connect to DoH you get SSL_ERR_BAD_CERT_DOMAIN. The only option it seems is to VPN or play the cat and mouse game now to find a DNS that hasn't been rerouted yet
    • defrost 2y ago
      You might get some joy from using Portmaster (windows OS) and|or the Foundation for Applied Privacy https://wiki.safing.io/en/Portmaster/App/DNSConfiguration https://wiki.safing.io/en/Portmaster/App/DNSConfiguration https://applied-privacy.net/services/dns/ https://applied-privacy.net/services/dns/ There are non standard transports for DNS via non standard providers | DNS proxies - this tool and that foundation are a start.
    • _lvbh 2y ago
      Where are you? My DNS seems to work perfectly fine right now in Penang (with VPN off). It’s sad that democracies are copying the playbook of China. Will definitely be using v2ray/X-ray while here
      • harrygeez 2y ago
        I'm in PJ. It seems that they have reversed the move after wide media coverage, claiming that it there has been a "confusion"
      • kelnos 2y ago
        > It’s sad that democracies are copying... "Democracy" is a bit of a red herring here. Democracy doesn't mean the government can't censor you or restrict what information or media you can consume. Democracy just means that the voters have consented to whatever legal framework is in place, and to whatever their leaders want to do within that framework. And that's the thing: in many democracies around the world, if there was a referendum on the law to blocking copyright infringement, online gambling, or pornography at the ISP level, I think many would pass that law. (Certainly there are "democracies" out there that only pay lip service to the concept, and have fixed elections and repression of dissent or opposition. I'm not talking about those.)
• CAP_NET_ADMIN 2y ago
  I'm wondering if they thought about DoT, DoH and DNSCrypt.
  • schoen 2y ago
    I hope not!
  • Joel_Mckay 2y ago
    Or people setting the DNS IP on their routers and phones: Google 8.8.8.8 8.8.4.4 Control D 76.76.2.0 76.76.10.0 Quad9 9.9.9.9 149.112.112.112 OpenDNS Home 208.67.222.222 208.67.220.220 Cloudflare 1.1.1.1 1.0.0.1 AdGuard DNS 94.140.14.14 94.140.15.15 CleanBrowsing 185.228.168.9 185.228.169.9 Alternate DNS 76.76.19.19 76.223.122.150 https://github.com/yarrick/iodine https://github.com/yarrick/iodine =3
    • hales 2y ago
      This will not work if ISPs redirect DNS queries. Only the methods CAP_NET_ADMIN mentioned will work.
      • deleted 2y ago
        [deleted]
      • Joel_Mckay 2y ago
        DoH APIs at these endpoints: https://dns.google/dns-query https://dns.google/dns-query – RFC 8484 (GET and POST) https://dns.google/resolve https://dns.google/resolve? – JSON API (GET) And tunneling obfuscated traffic is easy... =3
        • stingraycharles 2y ago
          These are being redirected by the Malaysian government as well.
          • 2y ago
• happyopossum 2y ago
  As a network guy, the fact that I can transparently redirect DNS on my network to wherever I need to is a nice feature. As a user of the public internet, it feels like a bug. As much hassle as things like DoH can be for securing and enforcing policy on a network, it’s about time it became ubiquitous enough that governments can’t leverage DNS for their own purposes anymore.
  • vFunct 2y ago
    DoH won't solve redirects. DoH only gets you to a secure query, it won't help you if the government decides to give you a falsified query. For that you'll need DNSSec, which maintains a cryptographic chain of authenticity to the root DNS servers. And DNSSec is even more rare than DoH.
    • xnyanta 2y ago
      DoH will prevent government from hijacking your query in the first place. These blockades are only possible because of DNS being clear text and suceptible to MITM
      • vFunct 2y ago
        That's one level of security, but even for DoH, it's possible for entities to attack and control an HTTPS server, returning falsified DNS queries, and now the antigovernment.com website you logged in to talk about anti-government politics is actually run by government. The only way to prevent that is via DNSsec to make sure that antigovernment.com goes to a real antigovernment.com server.
        • yegle 2y ago
          Wait what do you mean? They can have an HTTPS server and MITM, but how can they get a certificate for the DoH server I use?
          • labcomputer 2y ago
• aussieguy1234 2y ago
  In this case, the "malicious sites" that the government approved DNS providers block almost certainly includes life saving LGBT resources. It will not stop there however, expect anything anti government to be blocked. Democracy does not have a good track record in Malaysia. Of course there are still ways around this. Use a good VPN like Proton. This is still for sure going to be copied by authoritarian regimes worldwide.
  • csomar 2y ago
    Malaysia doesn't have a stellar democratic record but it's still a democracy. Also, a stellar democratic Malaysia will still vote for this. Don't confuse Democracy with Liberal values.
    • m2f2 2y ago
      [flagged]
      • Underphil 2y ago
        Pretty sure they protect the will of the majority, whoever they may be. That's my take anyway.
      • deleted 2y ago
        [deleted]
      • markdown 2y ago
        Nope. That's not what the word democracy means.
        • HeatrayEnjoyer 2y ago
          I'm glad you're here to correct everyone /s
      • bachskratch 2y ago
        [flagged]
• kazinator 2y ago
  Maybe the time to start a grassroots network for exchanging giant /etc/hosts files.
  • emersonrsantos 2y ago
    https://winhelp2002.mvps.org/hosts.htm https://winhelp2002.mvps.org/hosts.htm
  • boredhedgehog 2y ago
    It wouldn't have to be giant. Ideally, it would just include those entries that are censored for political reasons sorted by location.
    • sulandor 2y ago
      the dns-block block-list loving it
    • diggan 2y ago
      > It wouldn't have to be giant. Ideally, it would just include those entries that are censored for political reasons sorted by location. I think you're underestimating the amount of stuff being blocked everywhere. Even in Spain where I live the list of blocked domains would be pretty big already, and it's just one country. OONI gives a good overview: https://explorer.ooni.org/ https://explorer.ooni.org/
    • deleted 2y ago
      [deleted]
  • rty32 2y ago
    Only meaningful if you are on a desktop machine with root privilege (which most people here do have on their personal machines) You really need a solution that works on every platform for everyone, which isn't easy. Even for VPN like apps, well, they aren't allowed on China's Apple app store. Fortunately you can switch to a different store, download the app and switch back, and Android users can just sideload an apk as usual. But that's enough to show how complex this is. (Another reason I absolutely hate Apple's walled garden.)
• system2 2y ago
  Starlink sells and works there, will they block it? Also, how are they going to punish people with vpns and proxies?
  • abdullahkhalids 2y ago
    The purpose of banning VPNs is repressing political opponents. The police doesn't have to go around finding people who use VPNs. It's just that when the police arrest someone at a protest or for some trumped up charge, and the police also finds a VPN on the person's phone or computer, it is an easy charge to tack on - one that is certain to get punishment.
  • sneak 2y ago
    Starlink has to comply with local laws in places it is sold. It’s like any other business.
  • protocolture 2y ago
    Starlink always complies with all ISP laws in every country. Its not some magic anti censorship button. Shit mostly it exits a country via ground stations in that country or a compatible legal jurisdiction. Its not even magically flying out of the country via satellite. + Discussions about its ability to skirt censorship in this fashion with any significant capacity sort of paint it as a bad move, maybe that starlink 2.0 nonsense.
• MrThoughtful 2y ago
  Do FireFox, Chrome and Safari still use unencrypted channels for DNS queries? What is the state of DNS over HTTPS?
  • profmonocle 2y ago
    `sudo tcpdump port 53` says yes, they do use unencrypted DNS. AFAIK Chrome has a hardcoded list of DNS servers which offer encrypted DNS. I.E. if your DHCP server tells your PC to use 8.8.8.8, 1.1.1.1, 9.9.9.9, (or the IPv6 equivalents) it will instead connect to the equivalent DNS-over-HTTPS endpoint for that DNS provider. This is a compromise to avoid breaking network-level DNS overrides such as filtering or split-horizon DNS. It's not limited to public DNS providers either, ISP DNS servers are in there. (I've seen it Chrome connect to Comcast's DNS-over-HTTPS service when Comcast's DNS was advertised via DHCP.) Of course, this is pretty limited. Chrome obviously can't hardcode ever DNS server, and tons of networks use private IPs for DNS even though they don't do any sort of filtering / split-horizon at all. (My Eero router has a local DNS cache, so even if my ISP's DNS servers were in Google's hardcoded list, it wouldn't use DNS-over-HTTPS, because all Chrome can see is that my DNS server is 192.168.4.1)
  • TacticalCoder 2y ago
    > Do FireFox, Chrome and Safari still use unencrypted channels for DNS queries? Firefox for sure has a "corporate" setting which guarantees that DNS queries are unencrypted, using port 53 (virtually always UDP although technically I take it TCP over port 53 is possible but a firewall only ever allowing UDP over port 53 for a browser works flawlessly). AFAIK Chrome/Chromium also has such a setting and making sure that setting is on bypasses DoH. I force all my browsers / wife / kid's browser to my own DNS resolver over UDP port 53 (my own DNS resolver is on my LAN but it could be on a server if I wanted to). That DNS resolver can then, if you want, only use DoH. To me it's the best of both worlds: "corporate" DNS setting to force UDP port 53 and then DoH from your own DNS resolver. The benefit compared to directly using DoH from your browser is that you get to resolve to 0.0.0.0 or NX_DOMAIN a shitload of ads/telemetry/malware/porn domains. You can also, from all your machines (but not from your DNS resolver), blocklist all the known DoH servers IPs.
  • 2y ago
• userbinator 2y ago
  ...and again the number of people who know what a VPN is increases.
• sixthDot 2y ago
  > online gambling (39 per cent) well well well. People on HN will be surprised to know that the internet is a complete shit hole. "I thought the internet was made for the good of humanity".
  • giorgioz 2y ago
    > online gambling (39 per cent) It's 39% of the IPs banned by the DNSs of the ISPs of Malaysia. It's not 39% of the internet.
    • sixthDot 2y ago
      yes, that was well understood. A country decides to filter because the least poor citizen, those who have internet access, prefer to gamble online to make money.
      • ghnws 2y ago
        Make money gambling?
  • protocolture 2y ago
    I am not surprised by there being gambling on the internet, its not exactly hiding.
• rasz 2y ago
  Malaysia, the land of: >‘You have shown determination’: Malaysian PM praises Putin, pledges closer ties 2 days ago" reminder https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17 https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17 43 Malaysians killed by Putin.
• blackeyeblitzar 2y ago
  Reminder: Malaysia is an officially Islamic country. It is strange given its location, but Islamization also took over other South and East Asian places as well, like the Maldives and Indonesia. Malaysia has had a history of religious discrimination from both the state and citizens, despite there being a freedom to practice whatever religion you want. Their notion of religious freedom is also strange, since in order to be considered a Malay you MUST be Muslim. And Malays get all sorts of additional rights and privileges (such as affirmative action). The country also has Sharia law courts - and this is a very real problem for personal freedom, because the Sharia court prevents Muslims from converting to other religions typically, and this forces people to have secret double lives, where privacy is critical. Restrictions on Internet access or violations of privacy/anonymity are a serious problem for those who may run into trouble due to religious discrimination built into Malaysia’s culture and law. Do not accept official explanations like protecting people from harm or stopping misinformation - control over the internet will be abused.
  • rognjen 2y ago
    > is strange given its location, Strange in the current context that it's not in the Middle East but not strange when you look at the map and see that it's a straight shot for a trading ship from the Middle East a thousand years ago.
    • GreenWatermelon 2y ago
      And the entirety of India (until the Brits arrived) was "controlled" by the Mogul Empire, which was mainly Muslim. Even Spain/Iberia had a huge Muslim population, until the Reconquesta Kingdoms committed large scale genocide and deportions of Muslims and Jews. And speaking of Unexpectedly Muslim, the Golden Hord (AKA Tattars) which existed on the Crimean region as one of the offshoots from Genghis Khan's conquests, was Muslim. In fact, they allied with the Mamluk kingdom of Egypt against Holugu, leader of another Mongol horde, Ilkhanate.
    • ValentineC 2y ago
      > Strange in the current context that it's not in the Middle East but not strange when you look at the map and see that it's a straight shot for a trading ship from the Middle East a thousand years ago. Funny enough, it wasn't a trading ship from the Middle East, but the then-Chinese empire: https://www.scmp.com/week-asia/article/2006222/chinese-admiral-who-spread-islam-across-southeast-asia https://www.scmp.com/week-asia/article/2006222/chinese-admir... (no paywall link: https://archive.ph/f8622 https://archive.ph/f8622)
• blackoil 2y ago
  Balkanization of the Internet is inevitable. As more and more people join it, there will be conflict between beliefs, values, and politics. Large markets like EU, India can keep companies aligned, but for smaller nations it will be easier to just selectively block global platforms and have local/compliant alternatives. China has shown it is possible and profitable.
  • prpl 2y ago
    intronet
  • profmonocle 2y ago
    I'm honestly surprised that the US doesn't have a legal framework to force ISPs to block IPs / DNS hostnames. I've been expecting that for 10+ years now, but it hasn't happened.
    • anal_reactor 2y ago
      It's because the US is so powerful they can take down any controversial website. See how literally all services with more than 10 users say in their terms of service "we don't want anything that might violate US law".
      • HeatrayEnjoyer 2y ago
        Isn't that just code for "don't post CSAM"?
      • andai 2y ago
        Is that also sites operated outside the US?
        • diggan 2y ago
          Obviously no, other websites follow the laws of their business entity/where servers are hosted usually. Not sure what parent is talking about.
• deleted 2y ago
  [deleted]
• deleted 2y ago
  [deleted]
• hunglee2 2y ago
  The tension between borderless internet vs national sovereignty is one of most important meta-conflicts occurring in the world today. What can be critiqued as draconian authoritarianism on one hand, can be defended as digital sovereignty on the other.
  • protocolture 2y ago
    authies always fall back on appeals to sovereignty why would fucking with the internet be any different
    • BlueTemplar 2y ago
      And those that look down on national sovereignty are suspect of being shills for imperialism (whether they realize it or not), which is an even worse kind of authoritarianism.
      • protocolture 2y ago
        people I dont like are just secretly this other kind of people I dont like, I have a very large brain.
        • BlueTemplar 2y ago
          I just have no idea how to parse that...
• nubinetwork 2y ago
  > protection provided by the local ISP’s DNS servers and that malicious sites are inaccessible to Malaysians. I'd really be curious if said "protection" is actually real... Between dynamic domain name generation (ala malware), and (potentially) a lack of public review... this sounds more like smoke and mirrors. Hopefully there is a way for users to set up a VPN and get access to a better DNS server without triggering the redirect.
• lemme_tell_ya 2y ago
  > It has been falsely claimed that the measure undertaken by MCMC is a draconian measure. We reiterate that Malaysia’s implementation is for the protection of vulnerable groups from harmful online content. That's how it _always_ starts out, the "its for your own good, trust me" excuse.
  • zarzavat 2y ago
    Malaysia famously banned the movie Babe because a talking pig might offend religious sensibilities. It’s a safe to say that freedom of expression is not a high priority over there.
  • 1oooqooq 2y ago
    "think of the children" is never out of style. but remember we have this (widespread from 90s to 2010) to this day in the USA, and they don't even bother with excuses. just shove advertising and hijack searches right on your face. google didn't force httpsdns on your browser for nothing. it was digging in THEIR pockets.
    • pipes 2y ago
      Not exactly the same thing, as it isn't a law.
      • speedchess 2y ago
        Which makes it worse in many ways. The entire tech, business, etc world has adopted the same censorship regime without government orders. So who is giving out the orders?
        • linotype 2y ago
          Shareholders.
    • spacemanspiff01 2y ago
      Why does Google benefit from httpsdns?
• consumerx 2y ago
  „It’s for our own good“, lol. Don’t buy it. Don’t comply.
• known 2y ago
  [dead]
• djohnston 2y ago
  Sad to see Malaysia relegate itself to yet another Islamist backwater. They had so much potential.
  • timomaxgalvin 2y ago
    Somewhat hyperbolic.
• ra 2y ago
  Wouldn't this be trivial to get around by using DNS-over-TLS /QUIC? nonetheless, a slippery slope
• Eumenes 2y ago
  I have no problem with this. They are a sovereign country. Third party DNS, like Google, the aggregation of DNS query data could be used for nefarious or for-profit purposes. I encourage everyone to setup unbound.
  • Aissen 2y ago
    How would unbound work if your recursive queries to authoritative servers are redirected to local ISP servers instead?
    • Eumenes 2y ago
      Oh I misunderstood. The government is redirecting requests to local servers, not local user machines.
• tryauuum 2y ago
  yet another country decides to protect people from harmful information. What is harmful -- well, the government will decide
• Darulquran-123 2y ago
  [flagged]
• dudeinjapan 2y ago
  Also in Malaysia (coincidentally around same time) MCMC hard blocking of SMS which contain URLs. Not clear if there's someway to whitelist certain URLs/domains--does anyone know? Broke our TableCheck reservation notifications. https://www.thestar.com.my/tech/tech-news/2024/09/02/mcmc-bans-sms-with-hyperlinks-callback-numbers-and-personal-info-requests-from-sept-1 https://www.thestar.com.my/tech/tech-news/2024/09/02/mcmc-ba...
• nurettin 2y ago
  This is just dns, so they don't get the entire url. I know, slippery slope and outrage and stuff, but at this point it is almost expected that any government in the world with access to sufficient IT skills would start political internet bans.
• grishka 2y ago
  > pornography/obscene content (31 per cent), copyright infringement (14 per cent) > We reiterate that Malaysia’s implementation is for the protection of vulnerable groups from harmful online content. Who could possibly be harmed by pornography or, even more ridiculous, copyright infringement? Feels like a lame excuse. Internet censorship in my country (Russia) started the same way — "we're protecting children from suicide and drugs", but for some reason you couldn't opt out of the "protection" as an adult. To no one's surprise, over time, more and more things to non-consensually "protect" people from were added. In the end, unless you stick exclusively with local services, Russian-language content, and government-owned media, the internet is utterly broken without a VPN, packet fragmenter or other anti-censorship solution. Popular VPN protocols are also starting getting blocked, btw. All for your own safety, of course!
  • consumer451 2y ago
    Birds of a feather... https://www.bloomberg.com/news/articles/2024-09-05/malaysia-pm-anwar-praises-putin-pledges-to-deepen-russia-ties https://www.bloomberg.com/news/articles/2024-09-05/malaysia-... https://archive.is/lPbtj https://archive.is/lPbtj
  • ronsor 2y ago
    > copyright infringement I deeply implore you to think of the stakeholders!
  • jope12 2y ago
    Malaysia is a Muslim country. Pornography is illegal. Homosexuality is illegal.
  • abdulhaq 2y ago
    imo millions of people, mainly young men, have been sexually, mentally and spiritually harmed by pornography
• 99catmaster 2y ago
  For all the Malaysians on HN, how are y’all planning to handle this?
• foobaw 2y ago
  Very scary...
• uzyn 2y ago
  Due to the public backlash, Malaysia has changed their stance and not proceeding with mandating of DNS redirection. https://www.nst.com.my/news/nation/2024/09/1102836/updated-mcmc-ordered-not-proceed-dns-redirection-says-fahmi https://www.nst.com.my/news/nation/2024/09/1102836/updated-m...
• esbranson 2y ago
  TLS Encrypted Client Hello (ECH). Not sure of how difficult it will be to implement, but I would think it'd make DNS over QUIC (or whatever the DNS over HTTP/3 is) more robust against blocking. https://blog.mozilla.org/en/products/firefox/encrypted-hello/ https://blog.mozilla.org/en/products/firefox/encrypted-hello... https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/