(context: I'm the CTO of Quad9 and am one of the people dealing with the lawyers)
There is an understandable focus on "how are you going to block French users" when we have also claimed that geoIP blocking is insufficient for selectively denying resolution for certain names - we understand this conflict, but we think it is energy spent in the wrong place.
It is probable that we will use geoIP filters to block French users from our services after November 24. We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we've been told to make unavailable. But this would corrupt our core premise, which is that the DNS is not the right place for this to happen, and if we comply within France to meet the requirement then we accept the worst eventual outcome for users and we still do not have legally perfect coverage. We wish to first remain consistent with our core mission, and secondarily we must remain as close to compliance as we can to the legal constraints put upon us. By accepting the demands for blocking, we would admit that such demands are permissible within our mission - that we will act on behalf of companies (or others) to create ineffective and mis-directed regimes of content constraint.
We would be admitting that we think this solves the problem - it does not. We would be admitting that we will do this for an ever-increasing number of names - we will not. We would be permitting these methods to be applied for more areas of filtering such as moral, religious, social, or political reasons - we must not.
So we accept that there is the possibility that we will have errors in our blockade, but in this case (blocking French users) we maintain consistency with our stated mission of integrity of the DNS. We would rather there be a clear distinction made for users of our services: you get the DNS as you (the user) expects, or if Quad9 is forced to pollute the service with unexpected and arbitrary number of fragmentation demands, then we will not offer the services at all.
The underlying issue is not ONLY that geoIP blocking is ineffective, but that the entire premise of any of these demands is inappropriately applied to DNS recursive resolution providers. We would hope that this discussion continues to be on the most fundamental of the disagreement we have with the outcome in this court case, not on the details of the technical implementation which have yet to be entirely decided and which can be tuned over time.
If you have no presence in France do you need to care about the ruling or the fines?
Keep up the good fight! I'm happy that you take a stand for your beliefs and try to do what's best for all of us.
One can only hope the tribunal that rendered this ridiculous decision is one of the organizations that lose DNS access on November 24.
Thank you for the explanation! I couldn't agree more with your stance, and I appreciate deeply you fighting to maintain your (correct) principles. You've gained at least one fan and new user today.
Honest question here: why don't they target the operators for the nameservers that own the affected domain, basically the TLDs?
Oh right, the blocked domain is probably not a french TLD...
Quick question: what would happen if you decided to simply shield yourself from France’s action without applying any change to your dns? Or is blocking french users considered a compliant answer by French courts?
I don’t get why you would still need to block french users if you also need to exit the jurisdiction.
Because continuing to provide the service to French users would mean they have not exited the jurisdiction. You cant provide services in a jurisdiction and at the same time expect not be subject to that jurisdiction. That's just not how any country treats legal jurisdiction.
Hence the “shield” part. I guess it’s easier said than done when you’re a Swiss non-profit and not an anonymous sysadmin in Iraq (or whatever jurisdiction would work for this example, idk).
> whatever jurisdiction would work for this example
The Principality of Sealand*
* until the UK or French navy shows up
Yes but if you don’t have any assets in the country you could not liable, that was OP’s point.
But even being based in Switzerland I believe there’s some inter-countries agreements, so it would not be practical.
Let's say you are a software company based in country C (company) and offer services to users in country U (users), only over the internet, and having no physical assets in country U. You could imagine Microsoft offering Office 365 to customers in Liechtenstein, for example.
GP's point is that whenever you sell or offer something to users in U, you have to abide by U's laws in doing so - no matter whether you did that all while sitting at your desk in country C.
Whether or not enforcement or liability is realistic is up to the relationship between U and C I guess - my guess is France and Switzerland are on pretty good terms.
As a side project I help out with some technical stuff at a hosting company that provides services to a political group that is strongly anti Erdogan. The infrastructure is in the USA.
We do not block IP traffic from known Turkish ISP ranges. The customer (the political group) receives all sorts of dire legal warnings and threats that what they publish is contrary to Turkish law.
None of our other hosting platforms are configured to block any traffic to/from Turkish IP ranges. We have no business presence or financial involvement with anything domestically in Turkey. Am I subject to Turkish jurisdiction? I don't think so.
But by what you wrote, I am providing services in Turkey.
If you go to Turkey you might find yourself in a prison until you abruptly close this website. This is what happened to Pavel Durov (Telegram creator) in France. Telegram now complies with French law, because otherwise Pavel Durov would still be in French prison.
That's certainly a valid risk, if I were to put myself physically at the mercy of Turkish armed law enforcement inside their borders. In my particular case there's no public information that links my real name to the hosting company, as my work is behind the scenes.
Could Turkish intelligence link me to the company if they spent significant resources researching the hosting company that provides services to their political enemies? Probably. Do I have any personal plans to take a vacation in Turkey any time soon, or a pressing need to visit Turkey? No.
I am pretty sure we also have someone, somewhere hosting something that insults the King of Thailand, so I suppose that's a risk too.
Unrelated but hoping you could answer this:
There was a rumour years ago that Quad9 was connected to UK intelligence, or something like that. I haven't heard anyone discuss there for a long time, but wondering if you (or anyone reading this) can comment on the source of the rumours and whether there is any veracity to them.
The thing about DNS is that you can do your own investigations, rather than rely on rumour and innuendo. You can query their DNS and anyone else you can get at and compare results. You can use a VPN to appear to come from somewhere else or ask a friend to perform a query on your behalf.
You can literally [sigh] be your own journalist in this regard. All you need is a DNS query tool. I recommend dig but you might only have nslookup available out of the box.
Now, this UK intelligence thing. Even if James Bond Q's mates were actually running a DNS system you can still query it and compare it to someone else's view of the internet, say 1.1.1.1 or 8.8.8.8 or whatever.
You can also go to the source, ie root: . and work your own way down to decide on what is what.
Let's have a go at an analogy: DNS is (not really) a bit like a topographical map. You could buy your maps from DodgyRussianMaps'R'us and be surprised that Ukraine has somehow been subsumed by a bunch of murderous wankers. On the other hand you might buy your maps from HonestJonOffOfFaceb00c and note that it isn't. You can, of course, ask for a few other opinions and make up your own mind.
My real point is that DNS is actually quite hard to tamper with, without breaking so many things that everyone can know it is being messed with. When an org resorts to fiddling with DNS they've already lost whatever argument is to be had.
Sorry that you guys have to go through this. I use quad9 and it works great!
Better than geoip, y'all could work with the French to have French networks point to a black hole server by having BGP point 9.9.9.9 at said server.
I asked his elsewhere but aren't there like a prepondeance of existing case law or amicus-briefs that would speak to the logical and historical stupidity of arguments by the plaintiffs?
So, basically, you admit you will comply exiting all countries that ask for it; Pushing users to allegedly less safe resolvers in the name of security and integrity; And eventually ending the service in a couple of years because no one will be able to use your service since you'll be blocking most parts of the world and won't work without VPN exit in specific places. The decision is understandable, this really is a dillema I wouldn't want to take part in. You'll die by a thousand cuts of authoritarianism.
I haven't seen your donation to their legal defence fund? Cheque is in the mail?
It's strange that Quad9 openly does malicious domain filtering [1] using what it terms "threat intelligence feeds", but apparently filtering piracy domains is technically impossible and not the right place for this to happen. I think courts rightly are suspicious of this kind of doublespeak from DNS companies. If DNS filtering is effective for protection against malware and ransomware, it will be at least somewhat effective for piracy filtering too.
[1] https://quad9.net/service/threat-blocking/
Yeah, it's not the right place for it to happen. One's a service to protect the consumer, and the other is a corporate profit preserving concern. Why should a free DNS service be doing their work for them?
Because a court interpreted the law and ordered them to. And protecting companies from unlawful piracy is just as much a moral good as protecting the consumer from ransomware and threat actors. And if the DNS company can do the one, they can do the other.
protecting companies from unlawful piracy is just as much a moral good
bruh
> protecting companies from unlawful piracy
Counterpoint: piracy is moral.
Only if purchasing doesn’t mean ownership. ;)
Enabling the transfer of information from companies to people through piracy is a moral good
I’ll always support those who are willing to take such risks where I am not.
(context: I am the CTO of Quad9) Using those threat intelligence feeds is optional, as the blog post indicates. 9.9.9.10 & secondaries have no filtering.
The threat feeds we offer are in alignment with what the user expects and intends. Mandatory restriction of DNS resolution by a third party (not the user, not Quad9) is expressly what users do NOT want, regardless of the outcome. Once such restrictions are enacted and treated as normal, the channel for making demands will fill with a flood of "objectionable" names from every corner for every reason. Quad9 has already received demands from the French regulator to block sites which deliver adult content found to be objectionable to minors. We see an extremely slippery slope which has already moved out of piracy as the scoped intent which is this case in particular.
More to the point: prohibiting content via the DNS is a useless exercise when it is done out of alignment with the end users' goals - they will simply use some other recursive resolver (or their own) probably without the benefits of being oriented towards security and privacy. We have no monopoly on DNS resolution - there are thousands of others open to public use, and anyone can set up their own, for free, with no mandatory requirements by governments or regulators. This case (and any others like it) only drives out law-abiding organizations who are trying to promote better cyber hygiene and who want to keep the DNS as a single, un-splintered high-integrity pointer system.