Why PROTECT IP Breaks The Internet

from the collateral-damage dept

Last year, after the entertainment foisted COICA on an unsuspecting public, Paul Vixie -- a guy you should listen to when he's concerned about the technical impact of something on the internet -- explained why COICA's reliance on DNS block was incredibly stupid. Not only would it not work, but it would fundamentally fracture the way the internet works, creating massive collateral damage. Last week, when the Senate Judiciary Committee pushed forward with PROTECT IP, we mentioned in passing a new report from Vixie and other internet technology gurus explaining why PROTECT IP's focus on the DNS system would cause tremendous damage. While we had mentioned it, lots of folks keep submitting it, and judging from the ridiculous claims of those in favor of PROTECT IP, the folks in DC pushing for this bill are apparently still ignorant of what the report says -- so we're posting about it again. The report, titled Security and Other Technical Concerns Raised by the DNS Filtering Requirements in the PROTECT IP Bill (pdf) is worth a read. The five authors are incredibly well respected, and the entertainment industry folks who are trying to claim this paper can be ignored are going to come out of this looking quite silly.

These are concerns that shouldn't be taken lightly. The paper's authors also make it clear that they're not in favor of infringement, and in fact support enforcement of IP laws. They just recognize that this particular solution is dumb and counterproductive:

Two likely situations ways can be identified in which DNS filtering could lead to non-targeted and perfectly innocent domains being filtered. The likelihood of such collateral damage means that mandatory DNS filtering could have far more than the desired effects, affecting the stability of large portions of the DNS.

First, it is common for different services offered by a domain to themselves have names in some other domain, so that example.com’s DNS service might be provided by isp.net and its e-mail service might be provided by asp.info. This means that variation in the meaning or accessibility of asp.info or isp.net could indirectly but quite powerfully affect the usefulness of example.com. If a legitimate site points to a filtered domain for its authoritative DNS server, lookups from filtering nameservers for the legitimate domain will also fail. These dependencies are unpredictable and fluid, and extremely difficult to enumerate. When evaluating a targeted domain, it will not be apparent what other domains might point to it in their DNS records.

In addition, one IP address may support multiple domain names and websites; this practice is called “virtual hosting” and is very common. Under PROTECT IP, implementation choices are (properly) left up to DNS server operators, but unintended consequences will inevitably result. If an operator or filters the DNS traffic to and from one IP address or host, it will bring down all of the websites supported by that IP number or host. The bottom line is that the filtering of one domain name or hostname can pull down unrelated sites down across the globe.

Second, some domain names use “subdomains” to identify specific customers. For example, blogspot.com uses subdomains to support its thousands of users; blogspot.com may have customers named Larry and Sergey whose blog services are at larry.blogspot.com and sergey.blogspot.com. If Larry is an e-criminal and the subject of an action under PROTECT IP, it is possible that blogspot.com could be filtered, in which case Sergey would also be affected, although he may well have had no knowledge of Larry’s misdealings. This type of collateral damage was demonstrated vividly by the ICE seizure of mooo.com, in which over 84,000 subdomains were mistakenly filtered.

The defenders of propping up the business models of dying industries will brush these unintended consequences as no big deal or a "small issue" at the expense of "saving" the entertainment industry. This is because they don't understand the technology at play, the First Amendment or the nature of collateral damage. It's pretty ridiculous in this day and age that we still have to deal with technically illiterate "policy people" and politicians trying to regulate technology they clearly have little knowledge about. Only those who don't understand the technology think the collateral damage described above is minimal.

Filed Under: dns, internet, paul vixie, protect ip

The 18 Senators Who Approve Breaking The Internet To Protect Hollywood

from the not-cool dept

Last fall, we noted that the Senate Judiciary Committee had unanimously voted to approve COICA, a bill for censoring the internet as a favor to the entertainment industry. Thankfully, Senator Ron Wyden stepped up and blocked COICA from progressing. This year, COICA has been replaced by the PROTECT IP Act, which fixes some of the problems of COICA, but introduces significant other problems as well. A wide cross section of people who actually understand technology and innovation have come out against PROTECT IP as written -- including librarians, human rights groups, public interest groups (pdf) and various technology groups (pdf), including CEA, CCIA and NetCoalition. Most significantly, a group of internet/DNS specialists have made a strong case that this would break the internet in significant ways:

• The U.S. Government and private industry have identified Internet security and stability as a key part of a wider cyber security strategy, and if implemented, the DNS related provisions of PROTECT IP would weaken this important commitment. DNS filters would be evaded easily, and would likely prove ineffective at reducing online infringement. Further, widespread circumvention would threaten the security and stability of the global DNS.
• The DNS provisions would undermine the universality of domain names, which has been one of the key enablers of the innovation, economic growth, and improvements in communications and information access unleashed by the global Internet.
• Migration away from ISP-provided DNS servers would harm efforts that rely on DNS data to detect and mitigate security threats and improve network performance.
• Dependencies within the DNS would pose significant risk of collateral damage, with filtering of one domain potentially affecting users' ability to reach non-infringing Internet content.
• The site redirection envisioned in Section 3(d)(II)(A)(ii) is inconsistent with security extensions to the DNS that are known as DNSSEC.
• The U.S. Government and private industry have identified DNSSEC as a key part of a wider cyber security strategy, and many private, military, and governmental networks have invested in DNSSEC technologies.
• If implemented, this section of the PROTECT IP Act would weaken this important effort to improve Internet security. It would enshrine and institutionalize the very network manipulation that DNSSEC must fight in order to prevent cyberattacks and other malevolent behavior on the global Internet, thereby exposing networks and users to increased security and privacy risks.

So, with the people who actually understand this stuff pointing out that PROTECT IP would break the internet and go against various stated important priorities for the internet, you would think that the Senate Judiciary Committee might hold off before moving forward with such a poorly thought out bill.

But, you know, the Hollywood lobbyists want it. So, let's just ignore the people who actually understand this stuff and give Hollywood what they want.

This morning the Senate Judiciary Committee unanimously voted to move forward with PROTECT IP as is. It seems only fair to once again name the Senators who just voted (with a voice vote) to break the internet. Here's your list of technologically ignorant lawmakers of the day:

• Patrick J. Leahy -- Vermont
• Herb Kohl -- Wisconsin
• Jeff Sessions -- Alabama
• Dianne Feinstein -- California
• Orrin G. Hatch -- Utah
• Richard Blumenthal -- Connecticut
• Chuck Grassley -- Iowa
• Michael Lee -- Utah
• Jon Kyl -- Arizona
• Chuck Schumer -- New York
• Lindsey Graham -- South Carolina
• Dick Durbin -- Illinois
• John Cornyn -- Texas
• Tom Coburn -- Oklahoma
• Sheldon Whitehouse -- Rhode Island
• Amy Klobuchar -- Minnesota
• Al Franken -- Minnesota
• Chris Coons -- Delaware

Update: Oops. Pulled last year's list. Just corrected, removing Feingold, Specter and Cardin and adding in Lee and Blumenthal. Sorry, that was a dumb mistake.

Filed Under: dns, protect ip, senate

Paul Vixie Explains Why COICA Is A Really Dumb Idea

from the read-and-learn dept

If you don't know who Paul Vixie is, you should. When Vixie speaks about something concerning the underlying state of the internet -- or, more specifically, a ridiculously stupid government plan to do something involving the underlying state of the internet, you should listen. On that front, Vixie is now explaining why the proposed COICA bill is incredibly short-sighted and will fail miserably. He focuses on the requirements to block sites at the DNS level that the Justice Department has declared to be "dedicated to infringing content." As Vixie notes, people who don't understand the internet will think that this will stop access to pirated material. People who understand how the internet works realize what it will really do is drive people to alternative DNS systems. He lays out the rather likely scenario of what happens the second COICA passes, in which an alternative DNS system is set up, perhaps by folks associated with The Pirate Bay, and set up in a way that is compelling:

First, they'd decide in advance to mirror the IANA DNS system as closely as possible. Anything that appeared in the IANA DNS system would automatically and instantaneously appear in the Pirate Bay DNS system. If ICANN goes ahead and creates a lot of new TLDs then all of those new TLDs would appear in the Pirate Bay DNS system as well, all pointing at ICANN's chosen registrars. In other words no existing DNS content would be overridden (or dare I say: "pirated".)

Second, they'd pick some new TLD that they wanted to create in the Pirate Bay DNS system that would serve their business needs and would be extremely unlikely to ever conflict with any future IANA TLD. For this I'm thinking .PIRATE or .PIRATEBAY or .ARGHHH but that's a decision best left up to the artistic team. For now let's assume that they chose .PIRATE so that their second level domain names would be content names like TORRENTS.PIRATE or ITS-A-WONDERFUL-LIFE.PIRATE.

It goes on from there. I won't go through all the details he lays out (go there and read it yourself), but he basically concludes that this can be done quickly and cheaply. Of course, he may not know that plans for something along these lines have already been in motion for some time.

His basic point is that COICA won't work. At all. In fact, the growth and acceptance of such alternative DNS systems will break a big part of the internet, potentially in dangerous ways:

My greatest worry is what people will do to bypass all this junk or to prevent other people from bypassing it. My fellow humans are a proud and occasionally adversarial bunch and they don't like being told what they can't do or what they have to do. The things we'll all be doing to bypass the local DNS restrictions imposed by our coffee shops or our governments or our ISPs will break everything. Where this ends is with questions like "which DNS system are you using?" and "which DNS systems is your TLD in?" which in other words means that where this ends is a world without universal naming. We adopted DNS to get universal naming, and today we have universal naming except inside Network Address Translation (NAT) borders. Universal naming is one of the reasons for the Internet's success and dominance. If we're going to start doing stuff like COICA then we should have stuck with a "hosts file" on every Internet connected computer and let every connected device decide for itself what names it recognized.

So his recommendation is not to even try with COICA, but he recognizes the US government seems to want to move forward with it. He's pretty clearly warning that it's going to be a huge mistake with tremendous unintended consequences. Now, the only question is whether or not anyone in the US government will actually listen, or will they blithely move forward not realizing the almost obvious reaction to their initial actions? As so often happens with governments, they seem to forget that any move causes a reaction. COICA is a big move that most people pushing for it do not understand at all.

Filed Under: break the internet, coica, dns, paul vixie, unintended consequences

OpenDNS Comes Out Against COICA Censorship

from the good-for-them dept

Broadband Reports points us to a blog post from OpenDNS's founder and CEO, David Ulevitch, highlighting the dangers of COICA. He notes that services like OpenDNS already allow individuals the choice to block access to certain websites, but having the government declare entire sites blockable at the DNS level is definite trouble -- especially considering how much accidental copyright infringement there is.

What COICA proposes would induce, and in some cases, force ISPs -- including yours -- to block websites for you without your input. The Internet is a global phenomenon and at OpenDNS we serve a global audience with customers around the world. If we are forced to block something due to a mandate by the U.S. federal government it would impact all our users, not just those in the U.S. That's a terrible precedent for the U.S. government to set.

Furthermore, as we've seen with the ongoing Wikileaks.org saga, the government will try and utilize whatever resources it can to take sites offline. There is absolutely no need to arm them with a tool to automate it, let alone one that sits outside of any judicial review as COICA does.

Blocking a domain name is black and white act, meaning that if the Justice Department decided that one aspect of a website was enough to make infringement "central" their only recourse would be to block the entire website rather than systematically removing the infringing portion. For many sites this would lead to massive censorship of data and speech that was non-infringing.

While it looks like there isn't likely to be much movement on COICA in the lameduck session, it'll definitely be back next year. It's important that more people recognize that COICA is all about censorship before the bill goes much further.

Filed Under: censorship, coica, copyright, dns
Companies: opendns

Mistakes Were Made: How Tons Of People Started Slamming EasyDNS For Actions Of EveryDNS

from the error-correction dept

There's a famous paragraph that made the rounds a few years ago purporting to show that people really look at the first and last letters of a word and then assume the rest, more or less. It was:

Aoccdrnig to a rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a toatl mses and you can sitll raed it wouthit porbelm. Tihs is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe.

Of course, it turns out that this isn't quite true (and the research wasn't done at Cambridge). However, it is true that when people are reading quickly, they can sometimes sort of "guess" the word they're going for with the first and last letter. It seems that happened on a large scale last week, much to the chagrin of one particular company.

As you may recall, last week we were among those who wrote about EveryDNS killing Wikileaks.org's website, claiming a terms of service violation for getting DDoS'd. Before I did the post, I had checked EveryDNS's website, and hadn't seen any info about the takedown. Soon after I posted the story, however, the very first comment in the story said "Check EasyDNS.net's website" claiming there was an explanation. I quickly went to EasyDNS... and immediately noticed it looked entirely different than the EveryDNS site I had gone to originally, and rechecked the article. It was clearly supposed to be EveryDNS (as I had written), and the commenter was wrong (I also found the post that EveryDNS did put on their website about the issue). I pointed out that the commenter meant EveryDNS (and that I had now seen EveryDNS's explanation).

It turned out that that first commenter's mistake -- swapping EasyDNS for EveryDNS was done by a lot of people. I discovered that later, when someone from EasyDNS stopped by our comments to ask us to make the "correction" more prominent. And I was confused, because we hadn't made any error -- but had only corrected someone else in the comments. I then went and saw that EasyDNS had an entire blog post slamming journalists for repeatedly using their name in the stories about Wikileaks, including the NY Times, the Financial Times, Gawker, GigaOm... and us. Of course, we hadn't made the mistake, and I found it a bit amusing that, in a story about a lack of fact checking and publishing false information, EasyDNS had done exactly that to us. So I dashed off a quick comment on their blog post, and the EasyDNS guys were quick to correct the error and apologize both in the post and over email (thanks!). But it does highlight how easy it is to make a quick mistake when reporting on such things... even when you're reporting on mistakes!

Of course, the mistake had little impact on us... But for EasyDNS, it's apparently been a massive pain. The company has spent the past few days alerting people via Twitter that they were falsely accused, had nothing to do with Wikileaks, and did not, in fact, take the site down. Yet, it's one of those things that doesn't die (though, the company also put up a post about whether or not it would work with Wikileaks -- and also now appears to be doing some of the heavy lifting for elements of Wikileaks, these days) .

This is one of the reasons that I get a little wary of internet mob justice, of course. Lots of people are running around blaming the wrong company, because they're swapping an Every for an Easy. Of course, the IP lawyers in the house will say that this is what trademark law is supposed to be about -- that there shouldn't be two such companies since people can (and obviously do) confuse them. But it appears that both companies lived peacefully together in the world for quite some time before all of this mess.

In the end -- I'm not sure there's a good answer to all of this. The fact is mistakes happen. We make them all the time too (though, we didn't in this case -- even if we got blamed for one!). It can suck for those on the receiving end. For us, in this case, it wasn't a huge deal, but for EasyDNS, it clearly has been a major distraction. Hopefully it's active efforts on Twitter and various comment boards will help clear things up for most people. Perhaps the real lesson is that when you do make a mistake, and are informed of it, you should correct it as quickly as possible, and apologize for the mistake. And then everyone can get on with their lives.

Filed Under: dns, easydns, everydns, mistakes, wikileaks
Companies: easydns, everydns, wikileaks

With Domain Name Seizures Increasing, It's Time For A Decentralized DNS System

from the bye-bye-icann dept

We've already written about the latest legal loss for The Pirate Bay, as well as Homeland Security's new domain seizure campaign. With the former, the entertainment industry has already declared that it hopes this ruling will lead ISPs in various countries to start blocking The Pirate Bay entirely. It may also seek to use other tools -- like the pending COICA bill -- to see if it can seize the domain name. This presents all sorts of troubling questions concerning free speech and prior restraint. However, as is often the case when the law does a weak job trying to respond to a changing technological world, technology figures out a way to leap ahead.

Case in point, fresh off the legal loss, Peter Sunde, who has been focused on Flattr rather than The Pirate Bay, for quite some time anyway, has noted that he's working with some folks to set up a competing root server system that avoids ICANN. ICANN, of course, has been instrumental in helping Homeland Security with its domain seizures (and has apparently handed over Sunde's domain names to the recording industry in the past). The idea, apparently, is to set up a truly distributed and more secure DNS system that does not rely on a single party, like ICANN.

This certainly seems like a big challenge, and one that has a high likelihood of failure. But it does appear that we're seeing more and more problems with the way ICANN operates (though, it's been trouble since it first came into being). An alternative system, actually set up by folks who understand the technology could actually catch on, and could present a serious challenge for those who think they can censor the web in any manner -- whether for political or corporate purposes.

Filed Under: distributed, dns, domain names, peter sunde
Companies: icann

ISPs Hijacking Browser Functions, Continue Proud Tradition Of Value-Free Added Services

from the added-value-for-us-but-not-for-you dept

ISPs over the last few years have quickly rushed to embrace DNS redirection advertising. Instead of users being directed to a traditional page not found message (or Google in some browsers) should they enter a nonexistent or mistyped URL, they're redirected to an ISP-run search portal laden with advertisements. The concept creates a revenue stream out of your clumsy typing, giving ISPs an extra few bucks per month, per user (of course on top of whatever they make supposedly not selling your clickstream data). While many users don't like the practice, most ISPs provide some kind of opt-out mechanism (though they often don't work well), and users can often choose alternative DNS servers. Slashdot directs our attention to the fact that users continue to be surprised when they find out their ISP is hijacking user location bar results:

"Today I noticed that this great feature of Firefox (combined with Google of course) has stopped working, and has instead been replaced with an add-laden (sic) search result from another website. I've confirmed that my keyword.URL setting is still pointed at Google, so this must be happening at the traffic level, I would imagine either by use of a web proxy or something to do with DNS lookup, which makes me wonder if this new 'feature' my ISP (Netvigator by PCCW in Hong Kong) has introduced is also affecting my privacy?"

Here in the States one ISP (Windstream Communications) was recently busted for taking this concept one step further, going so far as to actually hijack Firefox Google search toolbar results. Windstream quickly backed away from the practice once users started to complain, insisting it was a mistake. However, the ISP wouldn't offer technical specifics about what technology they were using that created this "bug," and employees were told not to elaborate. To be clear, in Windstream's case this went well beyond DNS redirection, worked no matter what DNS servers were being used, and involved manipulating actual traffic streams using a new flavor of deep packet inspection. Whether this new layer 7/DPI is being used for copyright enforcement, surveillance, data mining or search result hijacks isn't clear -- but whatever it's being used for, it's being implemented with absolutely no transparency to the end user.

It seems unlikely that any U.S. ISP would take things further by hijacking toolbar results, given ISPs are busily trying to argue to regulators that network neutrality rules aren't necessary. Still, as deep packet inspection technology gets more sophisticated, precisely how ISPs are meddling with your traffic is something to keep a close eye on. ISPs already have a bad habit of offering value added services that fail to provide any value to consumers, and DNS redirection ads are only the latest example. ISPs were in such a hurry to grab this additional revenue, they failed to bother to make sure opt-out mechanisms for these "services" even worked, much less consider adding any kind of enhanced DNS functionality (as seen by companies like OpenDNS) that would make these services worth something to the end user. While DPI itself isn't bad, it holds a lot of potential for abuse among ISPs eager to make an extra buck at any cost.

Filed Under: browsers, dns, firefox, hijacking

DNS Screwup Accidentally Extends Great Firewall Of China To Chile And The US?

from the yes,-but-could-you-use-Google? dept

A bit surprised this story didn't get more attention, but apparently some sort of DNS networking "error" meant that certain computers in both the US and Chile came up against the infamous Great Firewall of China -- meaning many sites were suddenly inaccessible (and, one assumes, Google sent folks to Google Hong Kong):

Security experts are not sure exactly how this happened, but it appears that at least one ISP recently began fetching high-level DNS (domain name server) information from what's known as a root DNS server, based in China. That server, operated out of China by Swedish service provider Netnod, returned DNS information intended for Chinese users, effectively spreading China's network censorship overseas. China tightly controls access to a number of Web sites, using technology known colloquially as the Great Firewall of China.

The issue was reported Wednesday by Mauricio Ereche, a DNS admin with NIC Chile, who found that an unnamed local ISP reported that DNS queries for sites such as Facebook.com, Twitter.com and YouTube.com -- all of which have been blocked in China -- were being redirected to bogus addresses.

I'm reminded of the case when Pakistan tried to block YouTube and ended up blocking YouTube around the globe. Just a bit of a scary reminder of how fragile and interconnected the internet can be at times.

Filed Under: chile, china, dns, great firewall, us

Verizon's DNS Policy May Be Bad, But It's Not A Network Neutrality Violation

from the red-herring dept

While Comcast has been getting a lot of flack for blocking BitTorrent, some network neutrality activists have also been calling out Verizon for the way its DNS servers work. The DNS specification requires that servers return an error if the user tries to look up an invalid domain name. Instead, Verizon's DNS servers re-direct users who mistype an address to a Verizon-branded search page where Verizon gets to display advertising. (Incidentally, my ISP, Charter, does the same thing.) I agree with Ed Felten that this "feature" is obnoxious, especially because it can break applications that expect to receive DNS error messages. But I don't think it's really a network neutrality issue. Verizon's DNS server does not "block, interfere with, discriminate against, impair, or degrade" anyone's access to Internet content or services, which was the standard proposed in last year's Snowe-Dorgan legislation. Users who type correct URLs aren't impeded in any way from accessing the sites they want to visit. Responding to a failed DNS query with a search page is probably a bad idea, but it's very different from "redirecting a user from Google's search page to Verizon's," which the article implies Verizon might do in the future. Moreover, it's worth keeping in mind that you're not required to use your ISP's DNS server at all. ISPs provide DNS servers as a courtesy, the same way they might provide you with a free email account. But you don't have to use it. You're free to point your computer to another DNS server, such as OpenDNS, just as you can use a third-party email service such as GMail. And if you do that, the settings of Verizon's DNS server won't affect you at all. It's definitely fair to criticize Verizon for failing to follow the DNS specification, but calling it a network neutrality issue is a bit of a red herring.

Filed Under: dns, network neutrality
Companies: verizon