alt Hacker News(context: I'm the CTO of Quad9 and am one of the people dealing with the lawyers)
There is an understandable focus on "how are you going to block French users" when we have also claimed that geoIP blocking is insufficient for selectively denying resolution for certain names - we understand this conflict, but we think it is energy spent in the wrong place.
It is probable that we will use geoIP filters to block French users from our services after November 24. We could apply this same geoIP filter list now to selectively block French users from reaching the sites that we've been told to make unavailable. But this would corrupt our core premise, which is that the DNS is not the right place for this to happen, and if we comply within France to meet the requirement then we accept the worst eventual outcome for users and we still do not have legally perfect coverage. We wish to first remain consistent with our core mission, and secondarily we must remain as close to compliance as we can to the legal constraints put upon us. By accepting the demands for blocking, we would admit that such demands are permissible within our mission - that we will act on behalf of companies (or others) to create ineffective and mis-directed regimes of content constraint.
We would be admitting that we think this solves the problem - it does not. We would be admitting that we will do this for an ever-increasing number of names - we will not. We would be permitting these methods to be applied for more areas of filtering such as moral, religious, social, or political reasons - we must not.
So we accept that there is the possibility that we will have errors in our blockade, but in this case (blocking French users) we maintain consistency with our stated mission of integrity of the DNS. We would rather there be a clear distinction made for users of our services: you get the DNS as you (the user) expects, or if Quad9 is forced to pollute the service with unexpected and arbitrary number of fragmentation demands, then we will not offer the services at all.
The underlying issue is not ONLY that geoIP blocking is ineffective, but that the entire premise of any of these demands is inappropriately applied to DNS recursive resolution providers. We would hope that this discussion continues to be on the most fundamental of the disagreement we have with the outcome in this court case, not on the details of the technical implementation which have yet to be entirely decided and which can be tuned over time.
Replies
Thanks for fighting this.
I wonder how much longer the internet will manage to hold out. Governments will continue trying to impose their laws on it, causing the international network to degenerate to numerous national networks with heavy filtering at the borders. It's really sad to watch...
If you have no presence in France do you need to care about the ruling or the fines?
Thank you for the explanation! I couldn't agree more with your stance, and I appreciate deeply you fighting to maintain your (correct) principles. You've gained at least one fan and new user today.
One can only hope the tribunal that rendered this ridiculous decision is one of the organizations that lose DNS access on November 24.
Honest question here: why don't they target the operators for the nameservers that own the affected domain, basically the TLDs?
Oh right, the blocked domain is probably not a french TLD...
Quick question: what would happen if you decided to simply shield yourself from France’s action without applying any change to your dns? Or is blocking french users considered a compliant answer by French courts?
I don’t get why you would still need to block french users if you also need to exit the jurisdiction.
Unrelated but hoping you could answer this:
There was a rumour years ago that Quad9 was connected to UK intelligence, or something like that. I haven't heard anyone discuss there for a long time, but wondering if you (or anyone reading this) can comment on the source of the rumours and whether there is any veracity to them.
I’m sorry for being so dense, so what do you plan to do?
It sounds like selectivd site blocking is against your mission, so will you then just not offer Quad9 to any person in France instead (total blackout across all sites)?
Sorry if I’m missing the obvious or your stated solution.
Sorry that you guys have to go through this. I use quad9 and it works great!
Better than geoip, y'all could work with the French to have French networks point to a black hole server by having BGP point 9.9.9.9 at said server.
I asked his elsewhere but aren't there like a prepondeance of existing case law or amicus-briefs that would speak to the logical and historical stupidity of arguments by the plaintiffs?
[flagged]
So, basically, you admit you will comply exiting all countries that ask for it; Pushing users to allegedly less safe resolvers in the name of security and integrity; And eventually ending the service in a couple of years because no one will be able to use your service since you'll be blocking most parts of the world and won't work without VPN exit in specific places. The decision is understandable, this really is a dillema I wouldn't want to take part in. You'll die by a thousand cuts of authoritarianism.
It's strange that Quad9 openly does malicious domain filtering [1] using what it terms "threat intelligence feeds", but apparently filtering piracy domains is technically impossible and not the right place for this to happen. I think courts rightly are suspicious of this kind of doublespeak from DNS companies. If DNS filtering is effective for protection against malware and ransomware, it will be at least somewhat effective for piracy filtering too.
Keep up the good fight! I'm happy that you take a stand for your beliefs and try to do what's best for all of us.