Quote:
Originally Posted by
AwwDeOhh
This will be my last post on this particular side-bar topic, but in the interest of balance to the misinformation, anyone interested can read:
RE: "Will break the internet"
you're right aroundtheworld, i'm not an expert. But you know who is?
more than anyone here? the person who actually
invented the DNS SEC technology that would supposedly be 'broken'.
Paul Vixie said:
...
For the record, i'll take the actual inventors' word over how his invention works, over anonymous forum posters, thankyouverymuch.
Paul Vixie is very much against the filtering demanded by SOPA/PIPA on technical grounds (to say nothing of ideology); I don't know why you'd try to present him as supporting the technical plausibility of the measures.
Still, the paragraph immediately following your quoted selection
from this article is an interesting one to jump off from:
Quote:
Originally Posted by Paul Vixie on COICA, March 2011
Nevertheless the raw uncomfortable truth of the matter is that any form of mandated "DNS blocking" whose goal is to make certain domain names unreachable will be indistinguishable from the result of a Secure DNS failure β and a failure is a failure is a failure. We need informed debate on the question of mandated "DNS blocking" but we should be true to the facts and the details. Secure DNS and "DNS blocking" are ships in the night at the moment and whenever the goal of "DNS blocking" is merely domain name disappearance and not content insertion then "DNS blocking" will not break Secure DNS or even slow it down.
To rephrase that, the DNS resolution must return as a failure in response to a manipulated DNS entry. A hijacked/hacked name server is effectively the same as a filtered name server for an end-user. There are two important points in response to this, so let's use
a more recent Paul Vixie post to shed further light:
Quote:
Originally Posted by Paul Vixie on Refusing REFUSED, Jan 2012
The U.S. Congress' road to Stopping Online Piracy (SOPA) and PROTECT IP (PIPA) has had some twists and turns due to technical constraints imposed by the basic design of the Internet's Domain Name System (DNS). PIPA's (and SOPA's) provisions regarding advertising and payment networks appear to be well grounded in the law enforcement tradition called following the money, but other provisions having to do with regulating American Internet Service Providers (ISPs) so as to block DNS resolution for pirate or infringing web sites have been shown to be ineffectual, impractical, and sometimes unintelligible.
...
In summary, REFUSED doesn't mean what supporters of SOPA and PIPA want it to mean and no amount of new law can change that. There is in fact no signal in DNS that conveys the meaning of SOPA and PIPA, and every protocol perturbation thus far suggested by the supporters of SOPA and PIPA will look to DNSSEC like an attack or failure requiring circumvention. I urge anyone interested in adding new signals to DNS to please participate in the Internet Engineering Task Force (IETF) to work on a new Internet RFC document on this topic. As an open and transparent peer driven engineering forum, the IETF is ideally placed to study this problem, determine whether a solution is possible, and standardize such a solution for use on the global Internet.
These quotes are only marginally representative of the entire post; the whole thing is worth reading if you're interested in the subject -- it's a good history of the how the varying forms of censorship methods in proposed legislation would be handled in a real web environment. The gist of his position is that
in a DNSSEC regime, any kind of filtering will appear to user as a failure condition, and the redirections desired by legislation (and there are legitimate reasons to prefer redirections over failure responses, both as a matter of public policy and of technical coherency) are impossible under DNSSEC. Censorship can only appear to the end-user as a
broken internet (to borrow a phrase), and can so be of only marginal deterrence.
The second important point can be seen with the assistance of a
Paul Vixie interview:
Quote:
Originally Posted by Paul Vixie, August 2011
Say your browser, when it's trying to decide whether some web site is or is not your bank's web site, sees the modifications or hears no response. It has to be able to try some other mechanism like a proxy or a VPN as a backup solution rather than just giving up (or just accepting the modification and saying "who cares?"). Using a proxy or VPN as a backup solution would, under PROTECT IP, break the law.
I have a special concern about this since we will have to implement backup plans in the BIND validator. which we will not do if PROTECT IP passes. and without this kind of backup plan, DNSSEC itself will never be commercially viable.
His remarks toward commercial viability are of some importance here: the value of DNSSEC is closely related to how widely the protocol is adopted. If the obvious logical extension of failure responses in a DNSSEC implementation -- that is to say, a proxied or VPN'd alternate resolution path -- is outlawed (as it would have been under PIPA [the Senate's version of the House's SOPA]), then DNSSEC loses value (it can only fail to resolve a forbidden query, rather than detect manipulation and route around it), and the impetus for its adoption may be reduced, hindering the broad usage that is desired by anyone with a vested interest in network security (which is likely all of us: if you've ever used a credit card, or accessed your bank online, as two examples, then you should have an interest in network security!).