I’m glad to see you’ve come to the same conclusion I have—that people should have control over their DNS experience.  I’ve built OpenDNS on this core belief and the fact that 1% of the world’s Internet traffic is today routed through our servers is an indication of widespread support.  Pending some further analysis, OpenDNS will probably be a supporter of ingesting these feeds for our customers. 

As an aside, there will never be a market for RPZ data, just as there was never a market for MAPS data.  Value added companies like Postini and Barracuda emerged instead, providing what the market really wanted, which is a solution—not a technology.

This is an interesting proposal, but I was disappointed to see “speculators” tarred with the same brush as “scammers, spammers, [and] e-criminals.” Registering a descriptive domain name, putting advertisements on a parked page, and hoping to make money on ad revenue or a domain sale isn’t a malicious use of the DNS.

Blocking Spammers and purported criminals by subverting user intent is a road to hell - not necessarily paved with good intentions. Navigation gamesmanship destroys the value of domain names, ICANN, all registries and the DNS because it destroys the reason for owning names: Traffic and hope for future traffic.

Those who would consider such concepts have not thought through the ramifications of their wishes, or what would happen if everyone did the same as they did. Placing power in the hands of hollow platforms, which simply wheedle or game their way to the top of the navigation hierarchy removes uniformity from the global browsing experience, denegrates the utility of the Web and adds credence to those advocating the splitting of the root.

As an individual with Internet access,  I have only encountered David Ulevitch owned OpenDNS pages when I try to type the domain names of my colleagues (to confirm who owns them) and then unwillingly been redirect to OpenDNS parked pages which have been inserted in lieu of the parked page provider I was actually looking for. It’s a “classic” damming of the river upstream where the hotel or ISP I am viewing a website through, has contracted with OpenDNS to subvert the browsing experience, because it is economically expedient and seemingly consequence free to do so. No better than Gator’s virtual Wallet back in 2001. One advertisement subverted for another where that advertising revenue is shared with the ISP and OpenDNS or another subvertor.

The end-game of such gamesmanship at the DNS level should be plain for anyone with a shred of intelligence to see.  The land title office claiming, why don’t we just insert “our” name on the vacant property address…  Advertising replaced by other advertising held out to be the correction of an error.  An undesirable form of commentary held out as a crime. It is the final slippery slope will destroy the usefulness of the DNS and the internet you want for your children.

As the owner of many thousands of meaningful domain names which people request via browser type-in, I may not be loved by the DNS community for displaying advertising on my sites. I and those like me are frequently vilified by those who did not economically participate in the great domain boom and latecomers are constantly trying to rewrite the “errors” that allowed speculators to profit on domain names. The important thing to note is that the sites in question “belong” to the name owner. It’s THEIR site. They bought their way to the table when they bought the domain name which people request.

I reserve the right as the owner of the destination people seek, to display the content I chose - and I live with the legal, economic and ethical consequences of my decision when I stand as the registrant of the name.

Inserting yourself arbitrarily between a consumer who requests a site and the owner of that site because you woke up one morning and felt like you were helping the navigator (or hurting a site owner you arbitrarily labeled as malicious) makes you the bad guy. It is not your decision to make.  You are killing with kindness. When you re-characterize the human behavior of requesting a particular site as an “error” because it is economically useful for you, it makes you the criminal.

If nanny state concepts like these take hold it ultimately strengthens Google, Facebook, Twitter and other platforms.  It weakens all domain names, all new tlds, positive disruptive DNS related technology, registrar businesses, ICANN and global CC TLD registries. 

The very system we enjoy today, the profits at registries and cash flow-stream which fuels all ICANN matters, root Servers, working groups, constituencies, legal-fees comes from the registrants of domain names (big and small).  For that registration base to thrive we need freedom of Navigation, we need to reinforce that navigation will be authoritative and experiences will be uniform. 

Parasitic intermediaries, which would inject themselves are the undoing of the root.

When I look at the look at the last 20 years of the Web - the Microsoft, Google contest; it is Google who has done more ‘evil’ than Microsoft. It would have been easy for them to do so, but Microsoft has not stopped or shaped users navigating to domain names through it’s browser.  It is Google who has, via its toolbar, browser and exclusive search-index. The true evil is re-characterizing your evil as good. Google could not have become what it has without the kindness of Microsoft and had Microsoft played dirty, Google would have never been what it is.

Correction and blocking concepts such as these, rhyme with such evil. Calling yourself a good guy by subverting human intent is just evil.

I have long felt that the greatest threat to the Domain Name Industry, domain names, registries and ICANN are those who would renegotiate the browsing standards. I have learned that freedom on the Internet is provided by freedom of navigation. 

Cheering half-baked concepts such as these to a tipping point where everybody is subverting any experience they don’t like will make the modern Internet which gave us the luxury of sitting on our high-horse to criticize it, look like a twisted upside-down Planet of The Apes.  Only Less talking monkeys and more big-corporation, Big-brother structure.

this post starts with a bold assertion:
“Most new domain names are malicious.”

and the whole remainder of the post, and launch of this idea, is based on that statement. is it true?

this is quite inconsistent with our view of the data. we have a reasonable, and certainly statistically significant set of data. I am very interested in whether i) other registrars have a fundamentally different registration experience than we do, or ii) the statement is hyperbole.

I would love a deeper dive into the data, whether here or offline.

and @frank bulk, the author brought frank s in with this comment:
“Every day lots of new names are added to the global DNS, and most of them belong to scammers, spammers, e-criminals, and SPECULATORS (emphasis added).”

again, I wonder if that was a turn of a phrase or a thought out statement. if thought out, then there are real problems with this approach.

The DNS cannot serve every purpose for everyone.

The ICANN DNS is based on the principle of making access as easy and as cheap as possible. There are no checks made when someone registers a domain name today and it is implausible to expect that they can be established in the future.

There are many benefits to open-ness. But there are also disadvantages. The fact that someone wants to talk to me does not mean that I want to listen or that I have an obligation to try. It is entirely reasonable for individuals to choose to move to a smaller Internet of their own choice.

What is not reasonable is to expect (or for that matter allow) ICANN to do that job.

Internet crime is a consequence of an accountability-free approach to Internet architecture. Nobody sent spam when the consequence of doing so was being kicked off the computer system that was necessary for access. Spam only appeared when accountability-free Internet access started to emerge.

You don’t need the same degree of accountability for every purpose however. If I am browsing a Web site I probably don’t need a very high degree of accountability, unless that Web site wants to use javascript which is code that is going to run on my computer in which case the degree of accountability is a little higher, if they want me to buy something from them or run their software, the degree of accountability required becomes much higher, I want criminal sanctions in case of default.

And we are going to need even more accountability still if we are ever going to get to the ‘deep e-commerce’ that we all thought was round the corner in 2000, but kind of died with the dotcom bust and 9/11 and everything.

Paul’s suggestion is a positive one in my view. But I think to make it really work we have to be willing to adjust the DNS specs to suit. Using TSIG is OK, but I would like to have a more practical set up scheme than shared keys.

In the original Internet architecture, IP and packets were primary and the DNS was an afterthought. The architecture that has evolved makes DNS primary and the packets are just a means to an end. The DNS is the one part of the architecture that we can expect to be around in 200 years time. The packet layer will almost certainly be different, the DNS protocol itself will probably have been replaced a couple of times. But the DNS system will have survived.

At the moment the Internet has two identity infrastructures, DNS and PKI. The DNS is open registration, the PKI has tiered access. Domain Validated certificates can be obtained with minimal validation, but EV certificates require a demonstration of accountability. What we really need is a single system and the way to do that is to work out how we can leverage both existing infrastructures to build the infrastructure we need.

[Removed as per CircleID Codes of Conduct]

That is where the will lead, deeper and deeper down the DNS “stack”.

And if most all the largest ISPs dezone, for all intents and purposes the domain is not published. That will eventually be the excuse to move the ban to the registry entry. And what reasoable person will conclude ISPs will not “share” data?

As for email we choose our spam filters. We have no choice regarding the zone record “votes” others will make for our domains and those of our customers. The two are not comparable.

This “electronic democracy” is two wolves and a sheep deciding what is for dinner.

Ed:

I’m not following what you’re saying.  AFAIK, Google does not use BIND for their own DNS services.

Frank

How do you see Network Neutrality interacting with established ISP practices of spam filtering and selective port filtering?

I understand your concern that an ISP who uses the DRZ functionality in BIND would be providing a selective experience of which the subscriber may or may not be aware of, but that doesn’t interact well with the fact that ISPs (typically) do their best to provide a good and safe Internet browsing experience for their customers.

If as an ISP operator (I do that in my $DAYJOB) I can prevent most of my customers from visiting most $BAD sites that will infect their PCs for a minimal cost on my part, lowering my helpdesk support costs and reducing customer frustration and cost, how is that bad for either party?

I’ve neglected to mention that the ISP should be disclosing that their doing DNS filtering.  Customers know we do that with their e-mail and I readily tell them if the ask why port 445 doesn’t work across the internet.

Frank

Losing email is one thing (queuing) but lost sales etc of a down website is incomprehensible to me. You’ll have IT teams running around with no clue why their customers have no access. You have registrants calling hosting companies getting billed for the calls and the hosting companies scratching their heads while the meter runs. The business owner will be totally powerless and losing money. The smaller they are the more devastating this will be. And it’s worth the reminder that they might have had their server taken over. This will easily destroy small businesses if affected.
Large business are not going to have a great time either, but they will likely isolate the problem quickly and sterilize the problem just as quickly.
Abuse and exploits are admittedly my biggest fear. Some kind of spoof attack to sucker the system into deleting a specifically targeted zones for example.

With a DNS RPZ the website wouldn’t be down, it would just be inaccessible by those using a DNS server with using a RPZ feed that marks that site as undesirable.  Not unlike outgoing e-mail servers which sometimes (accidentally) get on a blacklist, that may happen with a zone.  No doubt that there’s risk with implementing an RPZ, but the painful reality of botnets and malware have brought us (well, at least hte ISC) to this point.

Frank

“Most new domain names are malicious.”

No surprise there.  By July 1996, the entire .net TLD was a “sewer”.

I can’t imagine what it has become since then, but I’m puzzled as to why the stock footage business at footage.net is your poster child for abuse.

Newsgroups: comp.protocols.tcp-ip.domains
From: .(JavaScript must be enabled to view this email address) (Paul A Vixie)
Date: 1996/07/06
Subject: Re: .com versus .net

> I am wondering what is the the real difference between a .com domain and a
> .net domain if you are registering for a commercial organization???

Generally this depends on your mood.  If you happen to feel like being under
the “NET.” top level domain, then you definitely ought to indulge yourself.
While once reserved for Network Infrastructure purposes, “NET.” has become
quite a sewer.  FOOTAGE.NET is my poster child for this kind of childishness,
but there are quite a few others which have nothing to do with infrastructure:

      APPLETON-BUSINESS.NET
      HOUSTON-BUSINESS.NET
      ALBANY-MARKETPLACE.NET
      FAMILY.NET
      WATER.NET
      CATALINA-INTER.NET
      AIRPORT.NET

The list goes on.  My ability to peruse it does not.  The point is, there are
no rules, “NET.” is the next “COM.” and you’d all better get your domains up
and running before somebody else beats you to it.  More, bigger, better, and
faster.  Never mind what it was intended for.  The InterNIC is not allowed to
turn you down, no matter what your “business description” says.  So why not?

(PS., Maybe if we pollute everything to ruin, folks will head to deeper water
and use domain names that make sense but have more dots in them, sooner.  So,
send that “NET.” domain application in TODAY!  Don’t delay!)
—
Paul Vixie
La Honda, CA             “Illegitimibus non carborundum.”

Absolute power currupts ...

Who’s talking absolutely power?  We’re just talking about DNS resolution here.  Let’s not blow this out of proportion.

Look, I’m all for making such a thankless job easier. Which is why the more pain you can focus squarely on the bad guys the more control you will REALLY have!

That’s what the DNS RPZ does, is focus on the bad guys.

Most new domain names are malicious.

This is a sweeping statement. However had a reputation based DNS option been available a few years ago when ICANN essentially facilitated Domain Tasting, then it could have solved a lot of the problems long before ICANN ever got around to dealing with the problem. But the current situation is not that Domain Tasting mess. There is still a level of malicious domain name registration but it would be unfair to say that most new domain names registered on a daily basis are malicious.

Many newly registered domains are automatically parked on the registrar’s PPC websites before they are used or developed. For some, they will stay that way until they are dropped without being renewed. Others are registered for the purposes of PPC and speculation but this does not mean that they are malicious registrations. Significant percentages of various TLDs are on PPC parking. In some cases, the percentages on PPC parking will come close to or exceed the numbers of actively developed domain names in that TLD.

This proposal has some very interesting possibilities but it may also have some unintended consequences. If it is implemented by ISPs, they will become the gatekeepers for their users. They would, in effect be a multitude of little versions of the “Great Firewall of China”. What if they start forcing users to use their DNS too?

The browser plugins would probably be the earliest users of such a blacklist. A whole section of the web could fade out of view in just a few months. The Direct Navigation model could take another serious kicking as a reputation based DNS could replicate the principle of Google’s reputation based link algorithm. The unintended consequence is that this could end up taking away the decision about what site to visit from the user and giving it to the ISP or someone else.

Speculation is how you bring future prices into the present.  Speculation is good.  More speculation is better.  Bad speculation isn’t a problem because the speculator runs out of money.  Unfortunately, there is subtantial overlap between the field of trademarks and domain names, and the rules differ between them.  Trademarks have had hundreds of years of case law; domain names hundreds of months.

For example, you can’t get a trademark on a product you aren’t selling, yet you can get a domain name for a product you aren’t selling.  For example, you can’t sell a competing product under a similar name by trademark law, but that works fine under domain names.  For example, trademarks have fields, but domain names don’t.

And unfortunately, a lot of what is called “speculating” is infringement, plain and simple.

It’s been fascinating reading through the posts that Paul’s announcement here has created.  There is a lot of passion coming throughout the threads from many posters debating the desirability of the mere “existence” of a mechanism like an RPZ.  Problem is, RPZ’s of some form have been with us for years and that debate is long over.  SURBL, Spamhaus, OpenDNS, my own company, and many, many others have been providing domain reputation services that can be used at the DNS resolver level (if desired) for years now.  A large number of enterprises (and even ISP’s) create their own custom block lists at the domain level, and implement them either in DNS and/or at the firewall to protect their networks.  Sometimes that even extends to the TLD level - for instance, a lot of enterprises block all of a TLD like .RU or .CN as a matter of policy.  Heck, some governments routinely block domains to “protect” their citizens. 

All Paul has done is create a standard way for people running resolvers to incorporate data from sources of their choosing.  He’s not “running” a list, just making it possible for anyone using BIND to easily choose a list(s) they like and use it to protect the users of their resolvers.  Those could be many, and vary depending upon the nature of the networks and users that use those resolvers.  For example, for a highly sensitive critical infrastructure environment, a network security officer may want to implement a policy that blocks entire TLDs, any domain reported as being malicious or compromised, and domains on hosts they’ve tracked trying to penetrate their networks from being resolved by machines on that network.  That same officer may choose a wide-open resolver for the public access network they run, and a “malware domain blocked” resolver for their employee network.  That’s just standard risk-assessment and implementation of security policies.  And yes, this kind of activity happens TODAY!  Lots of folks out there are using DNS level blocking in proprietary resolver solutions to stop malware communications, prevent employees from visiting phishing sites, and implement other aspects of their security policies.  Interestingly, the debate here has largely concentrated on port 80 resolution for the most part (web).  The beauty of using the DNS as a filtering tool is that malware and other undesirable activities happen over almost any port, so you can address all attacks at this level - of course if appropriate.  That way your employee’s machines can’t leak data to a keylogger C&C;, be part of the Conficker network, or anything else that can be quantified and blocked out via the DNS.  Of course, if you want to just block port 80 traffic, products/services like WebSense, NetNanny and others routinely block large swaths of domains based on their content type (yep, just like the anti-spam vendors blocking port 25 traffic!) so there’s yet another example of why the “existence of domain reputation lists” issue is moot.

So given the existence of these kinds of lists as a fact, the thing that’s really at issue here in my opinion is whether ISC’s solution is a good one, both technically and as a way to create a better, more open marketplace for reputation services.  The current solution set of proprietary ratings, kludged extensions, custom resolvers, and non-standard reporting by vendors, internal sensors, and data sharing partners makes it difficult for people running resolvers to evaluate reputation data quality and efficacy for their own purposes.  I applaud ISC for attempting to create a standard we can all look at and evaluate for whether or not it works, and potentially brings order to a rather chaotic marketplace.  In fact, I’d venture to say that by creating such a standard, you’re much more likely to see better accountability out of folks supplying such data.  Whenever you can compare things side-by-side, you get a better understanding of who’s doing a better job.  That can also lead to far better transparency by the way…

I do have some concerns/questions about the scalability of the ISC approach and would like to see some standardizations of how reputation is actually reported.  I think that’s a far more fruitful topic for debate here rather than should such lists exist at all.  As I said in the title to this post, that ship has sailed.  Deciding what this marketplace should look like, standards employed, implementation issues, and how it operates are of great interest to me.  I think talks about standards, best practices, feedback, and “governance” would be beneficial.

Hello,

I believe the ISC’s threat model regarding DNS black listing does not address all adversaries, and the proposal actually nullfies the distributed, fault tolerant nature of DNS.

Consider: under the current system, a government controlling a DNS operator(s) must approach each DNS operator with their [secret] request. Under the proposed scheme, the distributed, fault tolerant nature of DNS will be nullified. That is, a government only needs to poison the database of one cooperating operator, and other cooperating dns operators will dutifully incorporate the changes. To make matters worse, the poisoning will cross national/political boundaries - something governments don’t fully enjoy under the current system.

Email black lists (and the small number of associated failures) are generally acceptable. Email is only a service even though communications is a high value service. However, DNS is the ‘one ring to rule them all’, and I believe the risk associated with governmental subversions and tampering is not acceptable.

If history is an indicator of future expectations, the US will probably be the country to most abuse the proposed system, and the abuses will occur under the guise of national security. For those who claim otherwise, I still remember the NSAKEY incident, and note that US government is abusing both US citizens and foreign nationals under the gestapo legislation known as the PATRIOT Act.

I would bet the proponents of the ‘Internet Kill Switch’’ are salivating like Pavlov’s dog….

Jeffrey Walton,
Baltimore, MD, US

Hi Frank,

You’re presuming that all ISPs, all DNS operators, are using the DNS RPZ, are using ISC’s BIND, and have configured to use ISC’s new feature.  Since that’s not the case, you’re concern is vastly overstated.

Just to play devil’s advocate here: Is the ISC proposing a system they expect no one to use?

I claim the ISC’s proposal will enjoy popularity. It appears others, such as Ulevitch and his OpenDNS agree [http://www.circleid.com/posts/20100728_taking_back_the_dns/#6806]. This initiative will probably gain a sizeable share almost immediately.

Jeff

Truthfully I’m not concerned that this particular situation is the big bad or the undoing of browsing. I don’t think it will get traction.  But this trend is nobody’s friend. Looking at a domainer’s site and saying “I want to block or hijack that traffic because they are only showing advertising, and I can do that” is the classic road to hell because it disrupts thhe uniformity of the browsing experience.  Say tomorrow as the site’s owner I develop and one person sees the content and the next person doesn’t.  It’s bad because the lack of uniformity screws up the utility of the net.  And it sets horrible precedent for those wishing to limit free speech or subvert other forms of commentary.  I may not like the content at http://www.lemonparty.org but I respect the right of those folks to gross me out.  Long live free expression on the net. Advertising included.

This is how it could be presented by the ISPs: a value added service. The end users don’t have to use it but the selling point for ISPs would be that it would be a “more user friendly” and “safer” web. The problem is that most end users are not highly technical and such a service would build on their fears. The ISPs should be more transparent on this issue (and also on the NXDOMAIN monetisation) but would the customers care? Would they even know? If the ISPs were not transparent then the decision would no longer be the customer’s.

It’s about reaching the destination you intend. 

No Internet browsing individual wants a walled garden.  That was the excuse Prodigy and Compuserve gave for not opening up to the Web in 1994!!  My God, is this how far we’ve come in 20 years???  That we do exactly the same thing??  I know I’m getting old when I hear the exact same types of comments at age 40 that I did at age 20.  This is the same discussion as 20 years ago..  Let’s just hope the outcome is the same.. with free and unfettered access for all for the next 20 years - driven by customers who “Can’t get to the same site as their neighbor”. I can see the customer service folks in different call-centers left to defend the ill-intended actions of their employer: “It’s just a different version of the ad site you’re looking for!” 

Heaven forbid we stop serving stick men with shovels saying “this page is under construction” .. because one day soon, somebody is going to put up something IMMEDIATE and LIVE that they think the world should see at that inactive website and it would be a pity if some lumbering ISP is too busy forwarding other people’s visits directly to Yahoo!, to allow the new message of the site’s actual owner to resolve in a timely fashion.

“Avertising”, “information” or “protest” ..  A website’s content is the provenance of the site owner and ill-indended intermediaries inject themselves at their peril. I look forward to the congressional testimony from neer-do-well ISPs and Ad-maketplaces explaining why this is OKAY to do to the public they should be serving.

If an ISP or keyword marketplace wants to take traffic coming to any given website for it’s own, they should dig deep (as thousands have before them) and BUY the destination site their users seek.  To take what is intended for others, regardless of the content there, is to give rise to a cause of action to take their right to operate their ISP away from them.  I would be glad to stand as the plaintiff for such a class-action - and I suspect that some version of that may come at some point. There is a great deal of sympathy for net-neutrality and individuals have a right to stand tall and say “I get to choose my destination, regardless of the content my ISP thinks I’m entitled to.”

If after 20 years we’ve decided: “We’re tired of ad pages so let’s let the ISP decide what can resolve”, then the net as we know it is done. To paraphrase Franklin: Those who who would trade freedom for comfort, deserve neither.

Paul, apparently you want to redo for the DNS what you’ve done for SMTP 15 years from now.

SMTP RBLs have been useful for quite a few years. Let’s face it: they are not anymore. Having been on both sides (I’ve been both a provider and a user of RBLs), my opinion is that to date, SMTP RBLs are more a problem than a solution. They are only used now by people who don’t know better. They complicate mail server administration and are known to reduce reliability. There are tons of anecdotes about abusive blacklisting by RBLs, everyone can cite scores of examples of being unable to deliver email to some misguided big site using a bad RBL. RBLs tend to favorize big sites over small sites.

Did the RBLs solve the spam problem? Absolutely not. At best, they can be used for spam scoring. On the other hand, RBLs helped a lot in making SMTP delivery more unreliable than ever; many other antispam methods are much more efficient today. RBLs are mostly dead for antispam.

So I really, really don’t think it would be a good idea to try and apply the same ideas to the DNS. I can see nothing good coming off that.

I’m torn on the idea. As someone who filters spam, I love it. As someone who protects free speech it worries me. As many of you know the US is trying to censor the Internet by passing COICA - taking domain names offline who are merely accused of copyright violations. So when someone create a sucks site to expose bad products or bad business practices they are accuse of intellectual property crimes.

My point is to make sure the design of the system can not be exploited to suppress free speech as a side effect of stopping spam. Keep that concern in mind as you design your system.

Also - I would like to see some sort of DNS lookup to determine the age of a domain and the expiration date through DNS (high speed) as opposed to whois. That way domains that are very new can be distinguished for those who are established.

And so it begins, just 6 months later:

http://isoc.org/wp/newsletter/?p=3091

http://news.cnet.com/8301-31921_3-20029282-281.html

Perhaps ISP acceptance of government approved RPZ lists will be the “compromise” for not using the “off switch”.

And so it continues

“Algeria shuts down internet and Facebook as protest mounts”

http://www.telegraph.co.uk/news/worldnews/africaandindianocean/algeria/8320772/Algeria-shuts-down-internet-and-Facebook-as-protest-mounts.html

I don’t believe that’s been substantiated:
http://www.renesys.com/blog/2011/02/watching-algeria.shtml

http://www.piracynetwork.com/tag/wataniya-telecom-algeria

“A few that we checked were unreachable, including the telecommunications regulatory authority (http://www.arpt.dz), the Prime Minister’s office (http://www.cg.gov.dz), and other sites hosted at Djaweb (Telecom Algeria’s hosting brand).”

At this moment: http://www.algerietelecom.dz & AT.DZ
  - Not resolving
  - No reponse from name servers (DNS-*.DJAWEB.DZ, per article)

http://freedns.afraid.org/news/

“2011-02-13 19:16:12
It looks like service to mooo.com has just been restored.

As a reminder, it may take as long as 3 days to fully be restored across the entire internet, (172800 glue TTL + 86400 A TTL).

2011-02-12 07:07:07
Last night on Friday February 11th at around 9:30 PM PST mooo.com (the most popular shared domain at afraid.org) was suspended at the registrar level.

There is no ETA at this time. Due to the way propagation works it will take 3 days for a restoration to take effect.

freedns.afraid.org has never allowed this type of abuse of its DNS service.

We are working to get the issue sorted as quickly as possible.”

Reminder of a previous comment:

>And there shouldn’t be any legal recourse.

I think some comments in this page cut directly to the heart of my orignal comments in this very thread, regarinding “reputation”:

http://www.dotweekly.com/when-mooo-com-was-seized-by-ice-80k-subdomains-affected

“After about 26 hours they decided to unseize mooo.com (due to TTL it could take effect +3 days later in some parts of the world). But the damage was already done. Some people had to explain to visitors of their blogs that they weren’t pedophiles. ICE totally screwed up this time and risked peoples reputations and possibly lives. Vigilante justice is often acted upon accused pedophiles.

The child pornography warning graphic that was displayed”

This wasn’t about DNS reputation, it’s about suspension of someone’s registration.  It wouldn’t be accurate to conflate the two.

afraid.org is a DNS service whos customers now have a reputation of being pedophiles, becuase ICE said so.

This is about recognizing unaccoutable internet censorship.

As afraid.org says, they had no opertunity to face their accuser before their domain was rezone. A third party came in it did what they thought was right, no discussion. Obviously someone able to overide registrar and registry contracts felt mooo.com had a bad “reputation” and that we all need to be saved from it’s current zone settings, and used their ability to shut down that domain name.

We’re all smart enough to clearly see the analogy here.

It’ss different.  The implementation of DNS RPZ supports would allow ISPs to voluntarily use the DNS blacklist of their choice.  No gov’t intervention at all.  In Afraid’s case, a gov’t suspended their domain at the registrar level.  The only correlation is if the gov’t mandated the use of DNS RPZ with certain blacklists.  I don’t anticipate that happening.

“DNS blacklist of their choice.  No gov’t intervention at all.”

Why, after what we see ICE doing, should we belive governments around the world will NOT be publishing their own “recommended” DNS blacklist’s? And that laws demanding their use will NOT eventually follow?

“If you are on the no fly list, becuase you are known as maybe a possible terrorits”.
Rahm Emanual, White House Chief of Staff

When I was in school, if I said “you are known as maybe” in an english class I’m pretty sure I’d get a grade of F on that day, the trivium education is now dead .... Now such logical falicy filled statements become law.

We are moving in a very dangerous direction: internet censorship.

“What Libya Learned [shutdown] from Egypt”

http://www.renesys.com/blog/2011/03/what-libya-learned-from-egypt.shtml

http://www.japanfocus.org/-Makiko-Segawa/3516

”The measures include erasing any information from internet sites that the authorities deem harmful to public order and morality.”

And about 1 year later I believe the final link is now about to be put in place. Having censorship list features now built into BIND should make this very easy to implement now that ISP’s will have a “legal requirement” for implementation.

http://torrentfreak.com/anti-piracy-censorship-bill-passes-senate-committee-110526/

“order ISPs to block the website,”

http://www.pcmag.com/article2/0,2817,2385307,00.asp

“order ISPs and other DNS providers to blacklist certain Web sites,”

>If people start relying on the ICANN root signature for DNSSEC
>the US govt is going to be able to block domains through ICANN.

Centralization has a lot of management benefits. I prefer centralization for this reason.

However the power of the internet is too precious to humanity to allow manipulation by a single entity.

I’ve been watching for something like this for many many years, I knew this was comming it was fairly obvious. This is why DNS RPZ has infuriated me from the beginning.

Likewise I’ve pondered solutions, and it addresses the issue you mention. I see no way out of this except root splitting. China did this back in 2006 when they implemented IDN TLDs of .COM and .NET through I-DNS. The “monopoly” of the current root is an illusion, the root could be split overnight with minimal disruption. If fact this occured as far back as New.Net when my ISP at the time zoned New.Net in their DNS and thus all domains resolved without any plugin or other change to my PCs.

I think it’s time to split the root and eliminate root centralization.

It’s very unfortunate that it’s come to this, but I can’t see any other solution. Under that system, if the US gov wants to censor .COM’s, got fo it. They will destroy Versign as people move to TLDs that are out of reach of the US gov. If the US Gov then requires ISPs the filter the roots of other countries the reaction will be the same, commerce will be affected and so will large US companies who will have something to say about this.

From the internet user point of view, there really is no need for a centralized root. A TLD ROOT table on people’s PC’s is trivial to implement and store. When ISP then force back all DNS requests into their DNS RPZ, or other filtering mechanism, the next step will be to deviate from port 53 and plaintext.

Once the root is split at the TLD level there will be no way to stop the technical evolution of DNS “censor free zones”. It’s the only way I’ve even been able to come up with to end the arrogance.

>It’s amazing how you’re proposing that we split the root even before the
>threats (facilitated by DNS RPZ) to open Internet access have occurred!

They are occuring, and have been occuring.

The idea that they have not started is a statement that can only be made by someone that has not actually had to deal ISP blocking and manipulation issues.

If fact at this very moment I’m dealing with yet ANOTHER block of domains that an ISP is blocking as I work to see exactly what they are doing and why.

And for those reading this, the most simple proof of my statements is the most common manipultion that I’ve seen done for some time now. ISPs are ignoring TTL values and greatly extending them into the multihour range. They are also watching SOA records, and if they don’t like them they will mark the domain as having no record and block the domain.

And I’ve compared my notes with others managing tens of THOSANDS of domains, they are seeing the same things I am.

I’m long past giving anybody the benefit of the doubt. I had to switch ISPs to give me a clear uncorrupted veiw of the internet for management reasons. Over the past few months my current ISP has now started manipulations as well. I’m now out of options. The only way to get a clear view of the internet is setup a VPN to one of our colo racks and do my debugging out from there. That’s insane!

A peer in New York City has had these issues for years. I’ve sent them my custom written tools and they are useless, his ISP forces all DNS queries into their resolver thus denying direct DNS queries! This guy manages a lot of customers and this makes him totally blind to DNS debugging from his office and home.

And you want me to believe the problem does not exists? Sorry, long past that Frank ... Long past that by many YEARS ....

I’ve been involved in engineering for over 30 years. When it comes to White Papers, talk is cheap, and that to comes from experiance ....

>If you would be willing to document these blocks on a web page the
>broader community would definitely benefit from your research and work.

I think a better solution would be involving “domainers” in these discussions.

To date, due to their managing truely massive blocks of domains, they tend to be far more aware of these issues than most. And yet they are often demonized anytime they are mentioned.

This knowledge exists and is available.

While I appreciate your words, I’m nobody special. I’d rather see the various groups start working with domainers and tap the knowledge and experiance of their collective real world battle scars. The groups working together is a real solution, and one that will not easily succomb to number 33:

http://www.nizkor.org/features/fallacies/poisoning-the-well.html

>So is that DNS-OARC, EFF? or another group? 

There is no organized “group” representing domainers that I know of. That has been another major issue needing to be addressed in my mind. It’s been attempted in the past and then the group gets destroyed from within, and I think my comments above suggest what I feel is going on.

However there are some top people that post on CircleID, and to this very thread.

>This issue of blocking is enough of an issue for five
>persons to collaborate on a white paper.

It’s a truely massive issue, long past needing confrontation.

I’m glad to finally see more people concerned, and perhaps just plane pissed off ...

First step is Knowldege, next step is Action. Waiting any longer is NOT AN OPTION!

Just the threat of root splitting, so long as its REAL (no joking! no BS! MEAN IT!), is a useful tool at this point.

A 6 year old CircleID thread worth considering:

http://www.circleid.com/posts/splitting_the_root_its_too_late/

Splitting the Root: It’s Too Late
Dec 02, 2005 2:13 PM PDT Comments: 12 Views: 15,364

“One of the consistent chants we’ve always heard from ICANN is that there has to be a single DNS root, so everyone sees the same set of names on the net, a sentiment with which I agree. Unfortunately, I discovered at this week’s ICANN meeting that due to ICANN’s inaction, it’s already too late. “

“A friend who traveled to Arabic countries reported that ISPs simply reroute traffic for the public routes to their own root servers,

and most people are none the wiser except that Arabic domain names work.

He only realized what was going on when he tried to reach the Red Cross web site and kept getting the local Red Crescent instead, and tracked it down to the DNS returning different answers from what he’d expected to get from the usual DNS. “

Bill Clinton on “Reputation Management”.

http://www.politico.com/news/stories/0511/54951.html

I tried to find a video with just the discussion at issue and could not. The only one I could find was this one. The section of interest runs from time index 00:55 to 04:26

http://www.youtube.com/watch?v=iJgyfXIDAHk

does anybody know how the patent referred to here relates to DNS RPZ?

Given the complete lack of any explanation, patent name, or patent number, I gott ssuggest that no, nobody knows.

But I will say that they sound like another Intellectual Ventures sock puppet. Certainly an NPE.

I wonder what the date on the patent is, and whether my ignoreip patch is prior art: http://tinydns.org/djbdns-1.05-ignoreip.patch

>Post #17
>Phillip Hallam-Baker
>Yes, I was pointing to the fact that people can work round port 53 blocking.

>Post #32
>Ryan Singel
>I’ll find another DNS provider.

Now see this thread:

http://www.circleid.com/posts/20120327_dns_changer/

and this provided link:

http://dns-ok.us/

and this text on that page:

“Please note, however, that if your ISP is redirecting DNS traffic for its customers you would have reached this site even though you are infected.”

No, you can’t work around the intercepts / “redirections”, that is why they are there. And I’ve experianced them first hand. Any DNS query gets captured and FORCED into the ISP’s resolver.

Query to [any IP]:53 is routed to the ISP’s Resolver.

The march of censorship continues:

https://www.eff.org/deeplinks/2012/04/eff-joins-two-coalition-letters-opposing-cispa

“Crovitz: The U.N.‘s Internet Power Grab
Leaked documents show a real threat to the international flow of information.”

“Another proposal would give the U.N. authority over allocating Internet addresses.”

http://online.wsj.com/article/SB10001424052702303822204577470532859210296.html

http://www.circleid.com/posts/20120619_proposed_ietf_standard_creates_nationally_partitioned_internet/#8985

The proposal, entitled, “DNS Extension for Autonomous Internet (AIP),”

describes a way to give each nation, which the proposal cleverly calls an AIP, “its own independent domain name hierarchy and root DNS servers.” That would allow them to create their own top level domains without any need to coordinate them with ICANN or any other global entity. In other words, each country runs its own domain name space and decides for itself what TLDs exist and which domain names from outside will resolve in that space.

http://online.wsj.com/article/SB10001424052702303822204577470532859210296.html

The broadest proposal in the draft materials is an initiative by China to give countries authority over “the information and communication infrastructure within their state” and require that online companies “operating in their territory” use the Internet “in a rational way”—in short, to legitimize full government control. The Internet Society, which represents the engineers around the world who keep the Internet functioning, says this proposal “would require member states to take on a very active and inappropriate role in patrolling” the Internet.

http://www.ft.com/cms/s/0/9b122512-cb71-11e1-911e-00144feabdc0.html#axzz20UIa2J19

“Russia’s ‘internet blacklist’ sparks fears”

“Russia’s parliament has passed a law to create an “internet blacklist” in a move both internet and civil rights groups warn could be used to curtail internet freedoms in Russia.”

“High quality global journalism requires investment. Please share this article with others using the link below, do not cut & paste the article. See our Ts&Cs;and Copyright Policy for more detail. Email .(JavaScript must be enabled to view this email address) to buy additional rights. http://www.ft.com/cms/s/0/9b122512-cb71-11e1-911e-00144feabdc0.html#ixzz20UJ52woL

“Brett Solomon, executive director of human rights organisation Access, said: “The creation of a website blacklist looks like a power grab by the government to exert greater control over its citizens, silence opposition and win the ongoing political debate playing out on Russia’s internet.””

“High quality global journalism requires investment. Please share this article with others using the link below, do not cut & paste the article. See our Ts&Cs;and Copyright Policy for more detail. Email .(JavaScript must be enabled to view this email address) to buy additional rights. http://www.ft.com/cms/s/0/9b122512-cb71-11e1-911e-00144feabdc0.html#ixzz20UJDswjY

By the end of the week, the Duma is likely to pass a law forcing non-governmental organisations with foreign funding to register as “foreign agents” and submit to greater regulation, and it is considering another bill, aimed at the press, that would make libel a criminal offence. Last month, the Duma passed a law sharply increasing fines for protest violations, which opposition leaders say is a blatant attempt to intimidate demonstrators.”

Thousands protest in Japan against new state secrets bill

http://rt.com/news/japan-secrets-bill-protests-133/

http://hosted.ap.org/dynamic/stories/E/EU_TURKEY_INTERNET_RESTRICTIONS?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2014-02-18-14-34-59

“The legislation, approved by Parliament earlier this month, allows the telecommunications authority to block websites for privacy violations without a court decision. It also forces Internet providers to keep records of users’ activities for two years and make them available to authorities.”

http://news.yahoo.com/brazil-presses-eu-undersea-cable-skirt-u-links-115123537—finance.html;_ylt=AwrTWfz.cAtT4nwACq3QtDMD

“At a summit in Brussels, Brazilian President Dilma Rousseff said the $185 million cable project was central to “guarantee the neutrality” of the Internet, signaling her desire to shield Brazil’s Internet traffic from U.S. surveillance.”

“The Internet is one of the best things man has ever invented. So we agreed for the need to guarantee ... the neutrality of the network, a democratic area where we can protect freedom of expression,” Rousseff said.”

“Brussels is threatening the suspension of EU-U.S. agreements for data transfers unless Washington increases guarantees for the protection of EU citizens’ data.”

From the OP:

“I did help establish the “my network, my rules”“

what goes around comes around .....

next up, EU should setup a there own root servers. no doubt the privilege access NSA has to the A and B roots are traffic / traking tap points for them. when you have log files for the root servers, you have the beginnings of all internet communications ....

“when you have log files for the root servers, you have the beginnings of all internet communications”

this is wrong, and displays a common misunderstanding of the nature, meaning, and purpose of root name servers. they periodically tell each recursive name server on the internet how to find COM, NET, ORG, and around 300 other top level names. they see about 500K queries per second in the aggregate. there are likely 10B queries per second being answered at “the beginnings of all internet communications”.

i wish brazil well in their endeavours. if they ask my advice i shall give my best. i am not proud of the U.S.‘s snooping, nor its second class treatment of non-citizens and data belonging to non-citizens.

“this is wrong”

Strictly speaking, yes I am wrong. Functionally speaking I am correct.

Your background on this issue is known, mine is not. So let me fill in that blank. Many years ago I was dealing with DDOS attacks on my servers. My background is engineering, and Ive never feared setting a long block of time aside to focus on solving nasty problems. I decided to understand how DNS really does work. I found, as usual the RFCs to be useless. So I decided to hand code my own DNS server an implement it across tens of thousands of domain names. I did that over a decade ago, and the server does log every query. Analysis of the logs revealed many fingerprints that DDOS have in common, thus resulting in code that detects the attacks and ignores the false queries. In over ten years there has never been a successful DDOS on my server (knocking on wood here!). And given that I’m not that smart nor funded, has always raised the question in my mind of how ISPs can detect malware and stop providing customers service until they clean their PCs (Ive seen this first hand) and yet FAIL to do the same for DNS queries that have source IPs different that their originating IP on their network ..... Hmmmmm ... Like insurance companies, ive come to the cynical view that ISP like “problems” as they can then justify higher fees and justify other behavior (netflix caving to comcast for traffic transport payments).

After hand coding the DNS server, I hand coded a router, HTTP server, Email Server, etc. Having been a coder for almost 40 years I’ve noted how people tend to stay “in their box” and often miss the big picture. I certainly don’t claim to have the detailed level of understanding that many have, but I feel mine is pretty formidable at this point. And its my nature to look at systems and entertain myself trying to figure out how to break them, and thus hardened them ...

Now as I recall reading the details of the ISC root server, there was something like 30+ GBS of traffic in its system. Thats a bit different than “500K queries per second in the aggregate”. Of course as I know from looking at my own DNS logs, some days being as large as a gigabit or more, most DNS queries are junk at best and at worst attacks or probes

Yes, the root servers are suppose to just resolve the string to the left of the rightmost dot (the dot representing “root”). However the root server see the ENTIRE string for the query for which there was no cache higher up. So to start with, individual service queries DO make it to the root server fully intact.

While my use of the idea of log files was an attempt to be brief, and wrong, I will now use this an opportunity to make a point that I never see discussed. When queries to make it to the root server, the identity of the originating server is known as well as the ISP (Ip ownership info). Sadly most treat the 13 root servers as the 12 apostles sitting with Christ and thus can do no wrong .... The root servers DO NOT deserve such trust. Before the Snowdon docs what I’m about to say would be flatly rejected, but now I bet most with ponder this well .....

The A and B root servers are controlled by the US gov. If the US gov wants to respond to a query WITH A LIE (and short cache time), it can do so and a user on an ISP CAN NOT KNOW THIS. The ISP CAN know this IF they actually looked, but likely they NEVER WOULD. If they did look they could be bullied to shut up about it .... You may have noticed in the news lately there has been a rash of banker suicides, one having commited suicide with a nail gun multiple nails in his torso and his head ..... Hmmmmmm

http://theweek.com/article/index/256560/whats-up-with-the-recent-rash-of-banker-suicides

Funny how they seem to have some involvement with the LIBOR scam, considered to be the greatest financial scan in the history of mandkind ...

The so called hacker group “Anonymous” is a good thought experiment here. They get way too much credit for what they do. From what I have seen everything they have done can be accomplished by a person with a packet sniffer and access to a primary backbone of the internet ... And there are LOTS of such people. You see we have been trained to think that compromised PC are the primary threat to the internet, not the folks involved “on the inside” so to speak. The internet is “private wires” being stitched together, and each is given implicit trust it does not deserve .... So to such trust in the root servers is UNDESERVED.

Paul, I sit here in Salt Lake looking across the valley at a billion dollar NSA facility that I, and you, paid for with no idea whats its purpose is. With this post I think you understand I know DNS operations far better than most. And you know as well as I do, control of the responses of a root server, properly crafted, can allow communications to be incepted WITH EASE. Yes Paul, you cant intercept a specific transaction with ease, but you can eventually gain access to ANY PC or server you wish .... If you take your time.

While I cant prove the root servers are being used in this way, we have plenty of evidence that communications pathways ARE being intercepted:

http://www.zdnet.com/nsa-malware-infected-over-50000-computer-networks-worldwide-7000023537/

Paul, it would be very foolish to think the US gov has missed the opportunity to use well crafted responses at the root to intercept communications AROUND THE WORLD. Very foolish indeed ....

Sorry for using the idea of log files to convey a simple idea to lay people ..... However THANK YOU for giving me the opportunity to go into more detail about the issues I was getting at!

“Now as I recall reading the details of the ISC root server, there was something like 30+ GBS of traffic in its system.”

i was the founder of ISC and was its president for 16 years. f-root has never seen that amount of traffic except during DDoS events, and i’ll be very surprised if ISC ever went on record saying what you recall reading.

“Yes, the root servers are suppose to just resolve the string to the left of the rightmost dot (the dot representing “root”). However the root server see the ENTIRE string for the query for which there was no cache higher up. So to start with, individual service queries DO make it to the root server fully intact.”

this still represents a misunderstanding on your part, perhaps two misunderstandings. yes, some individual queries do make it to the root server fully intact. for each recursive name server to learn the TLD NS RRset, it must forward one query per DNS TTL for every TLD. once this has been done and the TLD NS RRs are all cached, that recursive name server will send zero queries to root name servers. exceptions are typo’s in the input names such that the TLD in the query is garbage and not in cache.

seeing one query per-recursive per-TLD per-TTL is not the same as what you claimed, nor is it a data leak that i’m particularly worried about. those who are worried about it can operate a stealth slave server for the root zone inside their network and avoid sending any queries to the 13 public root name servers. both ISC and ICANN make the root zone available via zone transfer to facilitate that configuration.

“The A and B root servers are controlled by the US gov. If the US gov wants to respond to a query WITH A LIE (and short cache time), it can do so and a user on an ISP CAN NOT KNOW THIS. The ISP CAN know this IF they actually looked, but likely they NEVER WOULD.”

protocol designers and implementers cannot take responsibility for ISP’s not caring. what we can, and have taking responsibility for is whether lies of the form you’re describing are detectable. i’m proud to say that with DNSSEC, yes they are. no root name server can answer with untrue (unsigned or mis-signed) data without detection. i wasn’t worried about the root server operators lying, but i’m glad that that concern is now “completely off the table”.

“And you know as well as I do, control of the responses of a root server, properly crafted, can allow communications to be in[ter]cepted WITH EASE.”

i also know that the root name servers are among the most closely watched parts of the infrastructure, and that there are safer and quieter ways to perform interception than to modify these responses. for example, nation-state created X.509 certificates having correct or wildcard distinguished names, and TCP/443 policy routing.

“Paul, it would be very foolish to think the US gov has missed the opportunity to use well crafted responses at the root to intercept communications AROUND THE WORLD. Very foolish indeed ....”

then colour me a fool, since my company (farsight security) operates the largest Passive DNS network in the world, and we see pretty much everything that the root name servers say, and we would know if the behaviour you’re describing was occuring—ever, not just rarely.

vixie

todays post on circleid:

http://www.circleid.com/posts/20140316_if_the_stakeholders_already_control_the_internet_netmundial_iana/

Go to Time Index 26:41   http://www.c-span.org/video/?317453-1/communicators-fadi-chehad

“How do we govern what is on the internet?” He makes that comment in regards to the issue “What is next”

http://news.yahoo.com/domain-name-revolution-could-hit-trademark-defence-un-231011348.html

“Under international rules, Web registration firms must void the registration of losers in WIPO cybersquatting cases. The UN body is already hearing its first case concerning a new gTLD, filed in February and pitting a German company against the Dutch registree of the still-inactive website canyon.bike.”

case was lost of a GENERIC keyword!

http://www.thedomains.com/2014/03/17/canyon-bike-lost-in-1st-udrp-decision-on-a-new-gtld-domain-name/comment-page-1/

its here, goodbye old internet, welcome new internet ....

http://news.yahoo.com/putin-foes-fear-internet-crackdown-blogger-law-sails-152919266—sector.html

MOSCOW (Reuters) - Russia’s upper house of parliament approved a law on Tuesday that will impose stricter rules on bloggers and is seen by critics as an attempt by President Vladimir Putin to stifle dissent on the Internet.

...

“The new policy is to restrict free information exchange, restrict expression of opinion, be it in written text, speech or video. They want to restrict everything because they’re headed towards the ‘glorious past’,” Anton Nosik, a prominent Russian blogger and online media expert, told Reuters.

“China is much more liberal than what Russia wants to achieve,” he said, describing the move as unconstitutional.

http://www.usatoday.com/story/news/world/2014/06/04/tiananmen-anniversary/9946783/

“BEIJING – Tight security around Beijing’s Tiananmen Square Wednesday combined with a months-long crackdown against dissidents and a quarter century of enforced amnesia to prevent public commemoration of the crushing of the 1989 pro-democracy movement.”

“What hasn’t shifted is official silence on the protests, backed by a massive security apparatus and strict control of the Internet. The entire “Beijing Spring” of 1989 is not taught in schools. Most Chinese are unaware of the sensitive date, called “6/4” in Chinese, which sealed in blood the Party’s approach to controlling a billion people: allow economic freedoms and punish those seeking political rights.

http://www.campusreform.org/?ID=5696

“Andrew Lampart, a student at Nonnewaug High School, was assigned a debate on gun control.
When he attempted to perform research on the issue, he discovered that many conservative websites and news outlets were blocked but their liberal counterparts were not.”

“I used my study hall to research gun control facts and statistics. That is when I noticed that most of the pro-second amendment websites were blocked, while the sites that were in favor of gun control generally were not,” Lampart told Campus Reform.”

“As FoxCT reports, “Lampart claims he alerted the Superintendent of Woodbury schools to the situation but, after a week, nothing was done. He took his concerns to the Board of Education on Monday.”

It is unclear if the Nonnewaug High School plans on adjusting the Political/Advocacy Groups section of restricted web pages. A request for comment from Nonnewaug High School was not returned in time for publication.”

a question i have is how many tax dollars went into setting up such a biased filtering system? what is the extent to which such filters have been designed and implemented across how many subject areas? perhaps this would be a good college thesis for andrew to research .....

http://www.circleid.com/posts/20140829_radical_shift_of_power_proposed_at_icann_govts_in_primary_role/

“Why ICANN would voluntarily choose to empower non-democratic governments with an even greater say over global Internet policies as this bylaws change would do is anyone’s guess.”

based on my posts to this thread over the past 4 years, i would suggest the reason is to allow greater access to the internet “off switch”.

https://www.techdirt.com/articles/20151119/19003432869/france-responds-to-paris-attacks-rushing-through-internet-censorship-law.shtml

“France Responds To Paris Attacks By Rushing Through Internet Censorship Law”
...
“It’s difficult to see how it does any good, and instead it opens up the possibility of widespread government censorship and the abuse of such a power.”

http://online.wsj.com/community/groups/censorship-america-1369/topics/french-government-plans-extend-internet

“French Government Plans to Extend Internet Censorship”
...

“PC Inpact and digital rights organization La Quadrature du Net have therefore argued that the bill puts “the entire Internet” under government censorship.”