4 ms·

Remember that some "censorship" is good. When FinFisher is being used by a repressive government against protesters and journalists, or a Zeus trojan has nabbe

by dsl 12y ago

Remember that some "censorship" is good. When FinFisher is being used by a repressive government against protesters and journalists, or a Zeus trojan has nabbed the credentials for your bank account, it's really nice for the security folks to be able to take down the domains being used for command and control.

joepie91_ 12y ago
Except that reasoning falls apart when you realize that the budget and start-up cost (in terms of money and otherwise) are significantly more favourable for a malware operation than for a legitimate but oppressed service. It's not worth it.
yarrel 12y ago
Botnet C&C can use IRC lookup or raw IP, so it's a particularly weak argument for DNS censorship.
Dylan16807 12y ago
It's really not that useful. They need to track down the bad actors, not put up weak communication barriers.
foxhill 12y ago
DNS is for humans to have memorable addresses, and can be trivially side-stepped.
AlyssaRowan 12y ago
Fast-flux or generated DNS are both pretty crap C&C bootstrapping infrastructures, and relatively traceable. I won't describe the really good ones, because I don't want to proliferate them.
- kordless 12y ago
  ...because you use them? I want an invite: akr has an invitation available If you know akr, you can ask them for an invitation to Keybase.
  - ryan-c 12y ago
    There are a lot of very stealthy, non-obvious methods that are easy enough to do once you realize they're possible. Some people don't like always going full disclosure. I have some things I've thought up that I won't share even though I don't use them. C&C over Tor has gotten some coverage in the last year, as an example.
    - kordless 12y ago
      I remember tracking down a bad BGP route advertisement in the 90s attributed to Cox. IIRC they ended up pulling a big chunk of some country's traffic into one of their routers. Realized then that the Internet was a fragile thing.
AnthonyMouse 12y ago
> Remember that some "censorship" is good. What you're describing as "good censorship" doesn't actually require any censorship at all. All you need is a mechanism to notify users (or their client software) that a name is designated as malicious. Then the user or the user's client can decide what to do with that information, including ignoring the designation and connecting to the address anyway. That way it can't be used for censorship but it can be used to put ye olde red screen of malware alert in front of the user.
- nibblepointer 12y ago
  How do you determine the authenticity of such notifications without a central authority?
  - AnthonyMouse 12y ago
    You obviously need someone to maintain the blacklist. That party could sign their work. If they do a poor job (false positives / false negatives), users and makers of client software can switch to some other blacklist maintainer at any time.

by dsl 12y ago

joepie91_ 12y ago

Except that reasoning falls apart when you realize that the budget and start-up cost (in terms of money and otherwise) are significantly more favourable for a malware operation than for a legitimate but oppressed service. It's not worth it.

yarrel 12y ago

Botnet C&C can use IRC lookup or raw IP, so it's a particularly weak argument for DNS censorship.

Dylan16807 12y ago

It's really not that useful. They need to track down the bad actors, not put up weak communication barriers.

foxhill 12y ago

DNS is for humans to have memorable addresses, and can be trivially side-stepped.

AlyssaRowan 12y ago

Fast-flux or generated DNS are both pretty crap C&C bootstrapping infrastructures, and relatively traceable. I won't describe the really good ones, because I don't want to proliferate them.

kordless 12y ago
...because you use them? I want an invite: akr has an invitation available If you know akr, you can ask them for an invitation to Keybase.
- ryan-c 12y ago
  There are a lot of very stealthy, non-obvious methods that are easy enough to do once you realize they're possible. Some people don't like always going full disclosure. I have some things I've thought up that I won't share even though I don't use them. C&C over Tor has gotten some coverage in the last year, as an example.
  - kordless 12y ago
    I remember tracking down a bad BGP route advertisement in the 90s attributed to Cox. IIRC they ended up pulling a big chunk of some country's traffic into one of their routers. Realized then that the Internet was a fragile thing.

AnthonyMouse 12y ago

> Remember that some "censorship" is good. What you're describing as "good censorship" doesn't actually require any censorship at all. All you need is a mechanism to notify users (or their client software) that a name is designated as malicious. Then the user or the user's client can decide what to do with that information, including ignoring the designation and connecting to the address anyway. That way it can't be used for censorship but it can be used to put ye olde red screen of malware alert in front of the user.

nibblepointer 12y ago
How do you determine the authenticity of such notifications without a central authority?
- AnthonyMouse 12y ago
  You obviously need someone to maintain the blacklist. That party could sign their work. If they do a poor job (false positives / false negatives), users and makers of client software can switch to some other blacklist maintainer at any time.