<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello Andre<div class=""><br class=""></div><div class="">An interesting take on a mechanism that’s been available for close to 7 years now <<a href="http://www.circleid.com/posts/20100728_taking_back_the_dns/" class="">http://www.circleid.com/posts/20100728_taking_back_the_dns/</a>>.</div><div class=""><br class=""></div><div class="">Largely I believe you’re on the wrong track with your post — at pretty much every level. Response Policy Zones (RPZ’s aka DNS firewalls) are a powerful tool to allow individuals, organisations or society better to control access to the darker corners of the internet. As per Vixie’s original paper (see above reference), this can circumvent a lot of harm for the average user.</div><div class=""><br class=""></div><div class="">As with any powerful tool, it can be used with ill intent but overall, this is a useful addition to an organisation’s security arsenal. </div><div class=""><br class=""></div><div class="">You express concerns wrt governments. Governments have a tendency to do what what they want to do irrespective of the tools available to them — after all, compliance with their rules is not their problem, they just need to prosecute those that fail to follow the new rules.</div><div class=""><br class=""></div><div class="">Irrespective of any philosophical objections you’re throwing out here, the resolution to your problem is incredibly simple — run your own recursive resolver. In this day and age an incredibly simple thing to do (which is another, markedly different problem).</div><div class=""><br class=""></div><div class="">Simon</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div><blockquote type="cite" class=""><div class="">On 2 Jan 2017, at 06:48, ox <<a href="mailto:andre@ox.co.za" class="">andre@ox.co.za</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hello,<br class=""><br class="">I wish everyone a prosperous & productive 2017<br class=""><br class="">I wish to cast light on an abuse issue that has the potential to<br class="">effect, affect and impact the entire Internet<br class=""><br class="">As among the proponents of this abuse are certain Government<br class="">Security Agencies and many other powerful forces, I beg with you to<br class="">attempt to understand how the changes being effected right now, also<br class="">affects yourself right now and how it will affect you in the future. <br class=""><br class="">My idea with this post is three fold, firstly, to educate, secondly to<br class="">open discussion and thirdly to agitate for change.<br class=""><br class="">DNS Abuse<br class="">----------------<br class="">Sometimes abuse is creeping, like weed in a garden it becomes more<br class="">and more and more and does not just happen overnight. In fact, it is<br class="">so creeping that we do not really see the weeds as we have become<br class="">used to seeing them.<br class=""><br class="">Just because there are so many weeds, it does not change the fact<br class="">that they are weeds and, in a well maintained garden, they need to be<br class="">eradicated for the well being of all the plants in the garden.<br class=""><br class="">To understand how this is even abuse, and how this will change your<br class="">own life and the Internet in the future, you need to also understand<br class="">some basic facts. The arguments for, against the standards, the basic <br class="">tech concepts, the functional aspects and then understand why this is<br class="">actually abuse and not just an evil movement, evil standards or<br class="">generally just plain old evil. <br class=""><br class="">Some important concepts in order to understand the technical logic and<br class="">the "explained purpose" and then, importantly, "the real purpose" of the<br class="">abusers:<br class=""><br class="">Trillions of domain names can resolve to a single ipv4 ip number<br class="">So, you could have <a href="http://ex.example.com" class="">ex.example.com</a> and <a href="http://ex1.example.com" class="">ex1.example.com</a> and<br class=""><a href="http://cat.example.com" class="">cat.example.com</a> - and have the same for unlimited names from unlimited<br class="">TLD to a SINGLE ip number.<br class=""><br class="">All Domain names are intellectual property - yes, even<br class=""><a href="http://abc.dsrtif.dsaurthp.example.com" class="">abc.dsrtif.dsaurthp.example.com</a><br class=""><br class="">If a DNS server is asked for an IP number for google.com and it<br class="">answers 127.0.0.1 to one user and 0.0.0.0 to a different user (makes<br class="">up its own answers) - This is simply fraud. as google.com is a<br class="">trademark. <br class="">(replace google.com with apple.com or ibm.com facebook.com or<br class="">any.example.com)<br class=""><br class="">The proponents of DNS abuse argue that they are 'protecting' innocent<br class="">users by using DNS as a 'firewall' to create 'walled gardens' and to<br class="">respond to one ip number for a certain set of users and a different ip<br class="">number for different sets of users<br class=""><br class="">Of course, this argument is fatally flawed as per my example above.<br class="">Their response is that there is sometimes multi homed ip numbers (100<br class="">domains on a single ip number) and that blocking per ip number blocks<br class="">innocent domains as well. <br class=""><br class="">In order for you to form your own opinion you need to know that the<br class="">majority of DNS servers use the same software and that there are new<br class="">standards being introduced to formalize Internet Fraud. This Internet<br class="">Fraud empowers African Dictators to easily justify 'walled garden'<br class="">countries and is set to revolutionize your own Internet access. It also<br class="">empowers, facilitates and allows easy management to aggressive <br class="">ISP's, multi nationals and many nefarious groups and people to manage<br class="">their activities. So, not only does the new software 'functionality'<br class="">exist, but it is being legitimized and formalized<br class="">by https://www.ietf.org/ <br class="">(whom, ironically, states:The goal of the IETF is to make the Internet<br class="">work better.)<br class=""><br class="">In a nutshell, the above illustrates that the DNS software used by<br class="">almost all of the Internet is to have functionality that allows DNS<br class="">operators to LIE to users, but to lie one lie to some/certain users and<br class="">another LIE to different sets of users (depending on whom is doing the<br class="">asking) <br class=""><br class="">That is not all...<br class=""><br class="">It also allows the DNS operators to hide the truth of these lies...<br class=""><br class="">and that is not all...<br class=""><br class="">The https://www.ietf.org/ is set to legitimize this nefarious behavior<br class="">under the flag of decency and good Internet operations.<br class=""><br class="">So, it would be perfectly fine and acceptable for everyone to start<br class="">doing this, as it will be a 'standard' <br class=""><br class="">What this means for you: The future Internet will not be free and open.<br class=""><br class="">Engineers supporting a non functional and fatally flawed approach to<br class="">abuse is an indication of a far more serious problem - you need to<br class="">think about that for yourself, and what that means.<br class=""><br class="">Of course, this in itself is abuse. This entire situation is Internet<br class="">Abuse and needs to be discussed as abuse.<br class=""><br class="">Andre<br class=""><br class="">--<br class="">more technical information:<br class="">https://tools.ietf.org/html/draft-vixie-dns-rpz-00<br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class=""></div></div></blockquote></div><br class=""></div></body></html>