29
Quad9 censoring DNS requests?
(lemmy.world)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 19 Apr 2024
29 points (83.7% liked)
Privacy
32024 readers
700 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
It might not be that easy, you're thinking about one single server running some kind of DNS server you're familiar with. When we're talking about Quad9, Cloudflare etc. were talking about hundreds of servers across the planet, highly distributed solutions that rely on multicast and other non-trivial techniques. If you've to change a system like that to add the ability to block something, trust me, it won't take a few hours.
It would literally be easier to add that capability to your own custom DNS server software. After all it is literally an "if query.name in blocklist then drop connection". Even replacing results would be simple as long as DNSSEC is not involved. You wouldn't have to add it though since all major DNS servers already include it because it is so simple and has legitimate uses, such as blocking malware control server names or ad blocking.
Yes, it is likely that most providers running custom generic or custom stacks already have the functionally built in and also yes, adding an "if" is easy but then once you’ve thousands of servers running the same piece of software across the globe deploying updates and features becomes way slower and way harder. You've to consider tests, regressions, a way to properly store and sincronize the blocklists across nodes etc...
How much simpler can I make this...
You have a primary 'master' server in the pool.
Replica/cache servers periodically ask the master for any updates.
Master gives a new update, which is a sinkhole for a marked malicious domain.
Replica/cache server now resolves malicious domain to the sinkhole address.
This is not a 'feature' you have to implement, it's a basic function of running a redundant DNS system.
DNS is literally distributed by design. It's how it works. Even if a deployment was done for some reason, it would not take more than a single engineer (an engineer really isn't even necessary for this, because again, it's built into DNS).
You know you can setup a single instance of PDNS or other resolver and by default they all work in a non-distributed way. You assuming to much, and again while it is likely that most providers running custom stacks already have the functionally built in, it isn't a guarantee and once you've thousands of servers running the same piece of software across the globe deploying updates and features becomes way slower and way harder.
That is not what they do, though. Just because a non standard configuration is possible doesn't mean that's the best thing to use. DNS, by design, uses authoritative nameservers, which is what cloudflare and quad9 host. These authoritative hosts distribute their records to caches (usually just recursive DNS resolvers) to ease and distribute the load. It's literally in all of their documentation, and explained in pretty plain english on their pages.
https://www.cloudflare.com/learning/dns/what-is-dns/ https://www.quad9.net/about/
When a record is updated in your domain (or cloud) provider, it is distributed via an authoritative nameserver hosted by that company. These get distributed to the root name servers, which then distribute the records to other authoritative nameservers.
I don't know why you're arguing over this, when it's one of the first things you learn in information systems and networking. Sure, there's a lot of stuff for the infrastructure. But the way DNS works on these hosts is still the same, and blocking a single record is not difficult and does not take extra engineering effort. The authoratative hosts simply change their records and it's done. DNS takes care of the rest.
There's an entire wikipedia page on this: https://en.wikipedia.org/wiki/DNS_blocking
The thing is, everything you said is correct. But if you think they can just solve this globally for everyone and everything without delays by just pushing things their root servers or the first line of authoritative ones then what else can I say.
They can, because that's how DNS works. This is why when you update a record for your domain it's updated globally in near real time with multiple providers. I don't know how else to tell you that it already works this way. I work in the cloud, and deal with this stuff on a daily basis.
Depending on the TTL, right ?
Correct!
So, you know that "near real time" is different from actual real time.
You're clearly going keep nitpicking and changing the subject to things that don't matter and you're not willing to learn. Your misunderstanding of the fundamentals of DNS is no longer my issue.
Okay, so tell me something, in your "ideal world" replication-based only scenario, what happens if they're ordered to take down a specific A record that has a very large TTL, more than a govt would like?