French Court Orders Google, Cloudflare, Cisco To Poison DNS To Stop Piracy (torrentfreak.com) 74
An anonymous reader quotes a report from TorrentFreak: A French court has ordered Google, Cloudflare, and Cisco to poison their DNS resolvers to prevent circumvention of blocking measures, targeting around 117 pirate sports streaming domains. The move is another anti-piracy escalation for broadcaster Canal+, which also has permission to completely deindex the sites from search engine results. [...] Two decisions were handed down by the Paris judicial court last month; one concerning Premier League matches and the other the Champions League. The orders instruct Google, Cloudflare, and Cisco to implement measures similar to those in place at local ISPs. To protect the rights of Canal+, the companies must prevent French internet users from using their services to access around 117 pirate domains.
According to French publication l'Informe, which broke the news, Google attorney Sebastien Proust crunched figures published by government anti-piracy agency Arcom and concluded that the effect on piracy rates, if any, is likely to be minimal. Starting with a pool of all users who use alternative DNS for any reason, users of pirate sites -- especially sites broadcasting the matches in question -- were isolated from the rest. Users of both VPNs and third-party DNS were further excluded from the group since DNS blocking is ineffective against VPNs. Proust found that the number of users likely to be affected by DNS blocking at Google, Cloudflare, and Cisco, amounts to 0.084% of the total population of French Internet users. Citing a recent survey, which found that only 2% of those who face blocks simply give up and don't find other means of circumvention, he reached an interesting conclusion. "2% of 0.084% is 0.00168% of Internet users! In absolute terms, that would represent a small group of around 800 people across France!"
In common with other courts presented with the same arguments, the Paris court said the number of people using alternative DNS to access the sites, and the simplicity of switching DNS, are irrelevant. Canal+ owns the rights to the broadcasts and if it wishes to request a blocking injunction, it has the legal right to do so. The DNS providers' assertion that their services are not covered by the legislation was also waved aside by the court. Google says it intends to comply with the order. As part of the original matter in 2023, it was already required to deindex the domains from search results under the same law. At least in theory, this means that those who circumvented the original blocks using these alternative DNS services, will be back to square one and confronted by blocks all over again. Given that circumventing this set of blocks will be as straightforward as circumventing the originals, that raises the question of what measures Canal+ will demand next, and from whom.
According to French publication l'Informe, which broke the news, Google attorney Sebastien Proust crunched figures published by government anti-piracy agency Arcom and concluded that the effect on piracy rates, if any, is likely to be minimal. Starting with a pool of all users who use alternative DNS for any reason, users of pirate sites -- especially sites broadcasting the matches in question -- were isolated from the rest. Users of both VPNs and third-party DNS were further excluded from the group since DNS blocking is ineffective against VPNs. Proust found that the number of users likely to be affected by DNS blocking at Google, Cloudflare, and Cisco, amounts to 0.084% of the total population of French Internet users. Citing a recent survey, which found that only 2% of those who face blocks simply give up and don't find other means of circumvention, he reached an interesting conclusion. "2% of 0.084% is 0.00168% of Internet users! In absolute terms, that would represent a small group of around 800 people across France!"
In common with other courts presented with the same arguments, the Paris court said the number of people using alternative DNS to access the sites, and the simplicity of switching DNS, are irrelevant. Canal+ owns the rights to the broadcasts and if it wishes to request a blocking injunction, it has the legal right to do so. The DNS providers' assertion that their services are not covered by the legislation was also waved aside by the court. Google says it intends to comply with the order. As part of the original matter in 2023, it was already required to deindex the domains from search results under the same law. At least in theory, this means that those who circumvented the original blocks using these alternative DNS services, will be back to square one and confronted by blocks all over again. Given that circumventing this set of blocks will be as straightforward as circumventing the originals, that raises the question of what measures Canal+ will demand next, and from whom.
Okay... letter not spirit. (Score:1)
Have address for site A point to site B and address for B point to site C and address for C point to site A. Done, DNS poisoned -- technically. Honest French court, the pirates won't figure that out.
Re: (Score:3)
From TFS:
the companies must prevent French internet users from using their services to access around 117 pirate domains.
So, the proposed solution doesn't appear to support the letter of the law, never mind the spirit. If the end result is just to direct users to another pirate domain.
Re: (Score:3)
Re: Okay... letter not spirit. (Score:2)
If past rulings in France are any indication, they want these bans to affect all french citizens, no matter where in the world the access it from.
Which IMO means the French government should require its citizens to identify themselves on the internet no matter where they access it from, that way non-french servers can easily determine who they need to ban to satisfy the French government.
If they can't do that, then these tech companies are probably going to have to simply exit the EU, and run their services
Re: Okay... letter not spirit. (Score:2)
You tell me.
https://www.eff.org/deeplinks/... [eff.org]
Canada believes they have this right as well.
https://www.courthousenews.com... [courthousenews.com]
Re: (Score:2)
Simpler solution: just block access to your DNS servers from France. That does comply with the ruling, is easy to implement and doesn't affect anyone else.
Look at who they're pressuring: Google, Cloudflare, and Cisco
Why do those entities offer publicly accessible recursive DNS resolution?
For Google, it's relatively low cost to run, and they get to track all those queries. That data is a gold mine to them. The cost/benefit to this means they'll block these sites so they can keep the data coming in from everyone else. Also, Google _STILL_ ends up getting the DNS queries for the troublesome domains, so there is zero loss to them by poisoning those DNS entries.
A
Re: (Score:2)
Re: (Score:2)
Couldn't they poison DNS to send all the pirate looky-loo types directly to the French Courts web page?
I'm sure that would turn on some people. Would their order apply to "Court Porn"? :-)
Re:This is not about the blocking (Score:5, Informative)
Copyright holders must, among other things, show vigorous defense of their copyright, least it will be considered abandoned.
I believe that's only applicable to trademarks, not copyright. A quick search seems to confirm that.
Re: (Score:2)
in which country's laws?
Re: (Score:2)
US at least. I would be surprised if anywhere in the EU was much different. What countries were you thinking of that are much different?
Re: (Score:2)
All countries that signed the Berne convention [wikipedia.org]
Re: (Score:2)
The US signed the Berne Convention.
The US does not require that "copyright holders must, among other things, show vigorous defense of their copyright, least it will be considered abandoned".
And yet this *does* generally describe how US law treats trademarks (though it overstates it.)
Clearly, somebody has confused trademark law with copyright law.
Re: (Score:3)
Any country that follows international conventions.
Copyright is absolute and cannot be waived through failure to defend. Ever. Essentially anywhere.
Re:This is not about the blocking (Score:5, Informative)
Copyright holders must, among other things, show vigorous defense of their copyright, least it will be considered abandoned. It also discourages the less adventurous/lazier violators. That the blocks as such are not very effective is fairly irrelevant.
You're confusing copyright with trademark.
Re: (Score:2)
127.0.0.1 is even better! :-)
Exactly what I use since I run my own resolver. It uses about 20 MB of ram (BIND). No third party like Google or your provider is required to resolve domain names and do your own caching.
Re: (Score:2)
Quad 9 + DNS-over-TLS and/or DNS-over-HTTPS is more secure than running your own recursive resolver if one of your objectives is to shield your queries from a nosey ISP that is looking to data mine or otherwise interfere with your DNS.
I run BIND locally, for caching, but it's setup to forward all queries to Quad 9 via DoT. All my ISP can see are a bunch of encrypted connections. If I was doing recursion rather than resolving they'd see many (most?) of my queries.
Insane ruling (Score:5, Interesting)
Re: (Score:3)
But the visual: Tilting at DNS windmills, the origins of Man of La Mancha is supposed to be Spanish, not French.
The righteous must be served. For others, there's always just finding the direct IP addresses.
I respect Canal+. There are better ways of putting moats around your property, and more effective ones, too.
Re: (Score:2)
The righteous must be served. For others, there's always just finding the direct IP addresses.
LOL, simply run your own resolver on your machine, as I posted above: "No third party like Google or your provider is required to resolve domain names and do your own caching."
Re: (Score:2)
The order seems also to overlook DoH, used by some people.
Re:Insane ruling (Score:5, Informative)
his is the same shitty locale that demanded everyone in their surrendermonkey country say "courier electronique" instead of "e-mail,
Of course not the way you present it. It only applies to government workers when writing government-issued documents, where it is a normal thing to use a normalized jargon. Every large entity has their own jargon defined for their public relations, and government is no exception. The same way, for example, regulations mandate government workers in France and other countries to always call females "Madam" and never "Miss" (the equivalent term in the local language), in this particular case such as to not create discriminations on marital status (again, this happens in multiple countries).
Regarding "e-mail", I recall you that Article 2 of the constitution of France dated 1958 prohibits the French Government to express themselves to French citizen in a language others than the official one. Therefore currently the government of France has no other option than proposing translations of foreign words when they need to use them in documentation.
The historical origin of this usage is set in the Ordinance of Villers-Cotterets, article CXI, by king Francis I of France, signed August 10, 1539:
And because so many things often hinge on the meaning of Latin words contained in the said documents. We will that from henceforth all decrees together with all other proceedings, whether of our royal courts or others subordinate or inferior, whether records, surveys, contracts, commissions, awards, wills, and all other acts and deeds of justice or dependent thereon be spoken, written, and given to the parties in the French mother tongue and not otherwise.
-- https://en.wikipedia.org/wiki/... [wikipedia.org]
By virtue of never being abrogated, and having constantly being applied (meaning it fails the criterion of legal obsolescence), the 1539 Ordinance is still legally binding to the government of France right now, 485 years after entering in force; though due to the hierarchy of norms, it is currently the constitutional terms that oblige the government of France.
Re: (Score:1)
No. I just know how asinine and xenophobic French culture and policy is regarding their language [thecambrid...ective.com].
The self-professed, principal function of the Académie is to ‘maintain and preserve the purity of the French language’ — a mission statement possessing of a surreptitious hostility. The process of ‘preservation’ necessitates near-clinical conditions; items must be kept airtight, hermetically sealed. Preservation is not simply an act of protection or maintenance, but rather o
Re: (Score:2, Insightful)
Let me guess - since you chose to butcher the English language repeatedly
Let me guess, English is the only language you understand. I suspect the OP is writing English since it's the only language you understand.
By the way English is not German. You need to hyphenate surrender-monkey. You can't concatenate adjectives to verbs improperly and then criticise others for the way they use your language.
You should be saying thanks to the multi-linguals for accommodating a simpleton like you rather than going on your pointless rant.
Re: (Score:2)
By the way English is not German.
Nah, in German Kapitulation Affe is written as separate words too.
Re: (Score:2)
But that means nothing.
It would be Kapitulationsaffe.
Re: (Score:2)
since you chose to butcher the English language repeatedly /// obsessed about the "purity" of your language
I have not commented about the "purity of the language" at all. If anything, it is your argumentation, by criticizing the mistakes of a non-native, that defends the purity of a language.
Re: (Score:2)
his is the same shitty locale that demanded everyone in their surrendermonkey country say "courier electronique" instead of "e-mail,
Of course not the way you present it. It only applies to government workers when writing government-issued documents, where it is a normal thing to use a normalized jargon. Every large entity has their own jargon defined for their public relations, and government is no exception. The same way, for example, regulations mandate government workers in France and other countries to always call females "Madam" and never "Miss" (the equivalent term in the local language), in this particular case such as to not create discriminations on marital status (again, this happens in multiple countries).
Regarding "e-mail", I recall you that Article 2 of the constitution of France dated 1958 prohibits the French Government to express themselves to French citizen in a language others than the official one. Therefore currently the government of France has no other option than proposing translations of foreign words when they need to use them in documentation.
I think most governments will require the government to communicate in the national language, I expect anything coming out of the German government to be German or the Mexican government to be in Spanish. The Welsh government publishes it's content in both English and Cymraeg (that's Welsh, in Welsh)
However when it comes down to normal conversation people are considerably less formal. Usage is the ultimate arbiter of language, unlike English, French has a central authority for usage, vocabulary and gramm
Re: (Score:1)
The average internet user (and the average French internet user) is not savvy enough to understand the cause, they will blame Google, CloudFlare and such, not the courts.
Re: Insane ruling (Score:1)
Re: (Score:3)
More like removing the sign with the street-name.
The thing is the TLD DNS in these cases is already in some other jurisdiction and does not care or they could have the site entry removed. And with that, any resolver that is not legally affected can resolve the server name (or do the next step if it is not a recursive one).
Re: (Score:2)
I would suggest that these large external providers simply stop responding to any IP address in France.
I see no reason why they shouldn't deny a free unpaid service to a couple million people because 800 of them are 'pirates'.
I'm sure a reasonable investigation would aid in finding these terrible illegals. Instead they're crying in public and doing stupid technical things that shouldn't be done.
Re: (Score:2)
Do as the court says and then never mention how ineffective it is.
Re: (Score:2)
I don't think DNS blocking is a good idea, but just on the point about DNS being global, these companies all run local servers inside France. Their CDN network directs users to the closest server, so they can in fact create the blockade just for the servers physically located inside France.
Re: (Score:2)
Also, isn't DNS global for many of these companies so they are trying to impose local laws globally which is a disaster.
Actually, no. Many DNS servers will give different results based on the source IP from which the query originates. Only at the root level is DNS truly global.
Re: (Score:2)
Are you trying to create a spike in the market demand for VPNs?
Another reason to run a local resolver (Score:4, Insightful)
Re: (Score:2)
Nobody asks the root for an A record.
You ask for the TLD NS records, then you ask one of them for the NS record for the domain, then you ask that NS server for the A record.
If they *could* force the roots to poison- they would.
The design makes it so they can really only target recursors.
Re: (Score:3)
Hahaha, yes. Asking a root server for anything is not a thing you want to do often. And they do not recurse. No idea how fast they are now, but 15 years ago you could wait a minute or longer for a root server to answer. They could theoretically poison the respective TLD server, but realistically, the TLD server will be in a different jurisdiction than the block order anyways or they could just as it to legitimately remove the domain. Hence you can either recurse yourself or ask somebody that also could not
Re: (Score:2)
Re: (Score:2)
No idea how fast they are now, but 15 years ago you could wait a minute or longer for a root server to answer.
Uhh, I've been on the Internet since the early 90s and I have never seen it take 60+ seconds to get an answer from a root server. The entire DNS system would break down if that were the case. Their answers come back in milliseconds, as do answers from most DNS servers worth a damn, and the root servers should be (in theory) even faster since they're authoritative only for TLDs and do not do recursion.
Re: (Score:2)
1) The Internet would not in any way "break down". DNS caching is a thing and root-server answers come with 48h lifetime by default.
2) I did not do any systematic study or anything, but I am pretty sure that is what I saw and I did the query repeatedly.
Re: (Score:2)
Thank you for mansplaining how DNS caching works. Now try mansplaining which root server you hit that took over >60 seconds to respond to a query. I just went through eight of them and all eight responded in under 30ms. The GLTD servers also responded similarity first when looking up domains under the various TLDs.
Re: (Score:2)
If you just want to be an insightless asshole, I will simply stop communicating with you. Or you could notice that I wrote "15 years ago" and no, the Internet would _not_ break down if root DNS were slow. Interestingly you have not even answered to that.
Re: (Score:2)
You might have noticed that my time on the Internet predates "15 years ago", I never saw the behavior you claim you did, and I said "the DNS system would break down", not "the Internet". You can quibble over the definition of "break down" by pointing to cache, except, server reboots/cache resets are a thing, and there's a long list of reasons why it would be problematic if it took seconds -- let alone minutes -- to get answers from the root servers.
I've been involved in systems administration, including D
Re: (Score:2)
You can easily do that. I have seen in Italy an ISP which was redirecting anything to udp/tcp port 53 to their own resolvers.
So, put any IP you want and you will get the same data, even if no DNS service exists on that IP.
But, that's harder to block DoH unless it only runs on specific IPs like 8.8.8.8.
Re: (Score:2)
It's not 1999. DNS is generally not done over port 53 by default anymore. In fact if you use either Chrome or Firefox you're firing DNS queries over under port 443 using DoH (DNS over HTTPS) by default.
Re: (Score:2)
I assume you have no idea on how DNS works.
Anyway, this might give you an idea on how much encrypted DNS is in use. https://stats.labs.apnic.net/e... [apnic.net]
Re: (Score:2)
You can easily do that. I have seen in Italy an ISP which was redirecting anything to udp/tcp port 53 to their own resolvers.
That is not poisoning the root, that's pretending to be the root. Entirely different situation.
And still entirely useless, since as mentioned- you don't ask the root for A records.
Really, all you're doing- is as I mentioned- poisoning the recursor.
Re: Another reason to run a local resolver (Score:2)
It's not poisoning root. It's pretending to be every DNS server on the internet. You don't need to poison root to give manipulated answers once you control the network.
Re: (Score:2)
You seem to have missed the point of my post.
Person I replied to said that "they could poison the root".
I then explained to them that due to the design of DNS- its hierarchical nature- one doesn't poison the root to take over a host record.
You have to target the authoritative nameserver for that domain, or whatever recursor the person is using.
In the case where the ISP cannot redirect all of the customer's DNS traffic (what the article is about, hence w
Re: (Score:2)
Simply use a VPN. Problem solved.
Re: (Score:2)
Continued attempts at poisoning may actually destabilize the way DNS works altogether depending how how far they go. If so, this opens up a vacuum for "what replaces DNS?" for those who reject the international censors. That's a good thing and a good question. The more decentralized the better in order to hide the control surfaces from individual governments.
Introducing chaos is not automatically an entry point for the good guys to mount their offensive. How did the breakdown of national security during 9/11 turn out? Maybe we could come around to something better. But unless someone can actually point to it as it presently exists and make a very good case for it to sweep in and save the day, I am going to be much more inclined to believe that the entities with massive amounts of political and economical power are going to get to resolve the chaos their way.
Th
Re: (Score:2)
Breaking things lets these entities get a do-over in dictating the outcome.
Good point. I was hoping for a do-over to make things less vulnerable to individual government policy. You seem to be pointing out that the do-over might give them more power and that's more likely.
The main advantage the free internet has right now is that much of it was defined before where it was going was obvious
Alas, you're right. The chance for building something else, like a nationwide WiFi/LoRa network using volunteers has already been thought of by governments and other bad guys. They now use the threat of kiddiepron to shut that down, as it's not clear what would happen to a volunteer run network if tested in court
Re: (Score:1)
But, it is nonetheless true that DNS poisoning is fundamentally a technique for compromising the security of computer systems that don't b
I assume they're going to fight this (Score:2)
Being a DNS resolver of choice isn't likely to last very long after you lose the public's trust that you're actually supplying the data they are requesting. These entities don't supply DNS services for fun, they have a profit motive.
Creating a new market pressure to use alternatives is not going to be very palatable to them.
Reminds me of threats to stop my email (Score:3)
Always funny because I run my own MTA. For DNS resolution, I currently use my ISP, but using a different DNS or even running your own recursive resolver is really not that hard. Who ever is impressed by a DNS block is truly a digital have-not.
If someone is pirating... (Score:2)
US 1AM trumps French court (Score:1)
The laws of the United States, in which these companies are based, disallow the government(s) to force publishing any speech of any kind, true or false.
That means Google, etc. have a constiutional US right to put what they want into DNS, although as an ITSEC guy I'll go with "just put the real data in there."
France is a great country, and I hope they eat their cheese and drink their wine and surrender to nazis... but they don't get to tell USican companies to poison DNS.
France courts - you have exceeded you
Re: (Score:2)
The laws of the United States, in which these companies are based, disallow the government(s) to force publishing any speech of any kind, true or false.
The US Constitution only places restrictions on US governments, not any other government.
but they don't get to tell USican companies to poison DNS.
They can in France where companies doing business there are required to follow French law, just as companies doing business in the US have to follow US laws.
Acts of terror (Score:2)
Acts of terror to support a commercial venture... I'm not so sure they thought this through.
Court tries to limit internet ... (Score:2)
Fails again ... because internet
Olympics (Score:2)
Yet another step in preparation for the summer Olympics. They are trying to make sure that all the money from streaming goes to authorized broadcasters and, ultimately, in part, to the French government.