Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malaysia backtracks on DNS redirection decision

thesun.my

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Malaysia backtracks on DNS redirection decision

#21

Post by nubinetwork »

skrause wrote: post #17
MonkeyClub wrote: post #5

Earlier quoted context omitted.

Greece is already way ahead! When one tries to visit some sites like LibGen, DNS is redirected to a "no-no you shouldn't go there" page, which in turn redirects to this official finger-wagging page: https://opi.gr/edppi_block/edppi_block.html DNS hijacking was also used during the beginning of the Ukraine affair as part of an EU-wide censorship push, blocking sites like the Kremlin and Pravda, though without further…

We're talking about two different issues though: 1. Blocking or redirecting some pages when using the ISP's DNS server. This is what you're talking about. The workaround is to use a third party DNS resolver. 2. Intercepting all unencrypted DNS traffic to any DNS server and redirecting it to the ISPs' DNS servers. This is what Malaysia was planning to do.

It sounds to me like Malaysia wanted to do both...

Re: Malaysia backtracks on DNS redirection decision

#23

Post by skrause »

nubinetwork wrote: post #21
skrause wrote: post #17

Earlier quoted context omitted.

We're talking about two different issues though: 1. Blocking or redirecting some pages when using the ISP's DNS server. This is what you're talking about. The workaround is to use a third party DNS resolver. 2. Intercepting all unencrypted DNS traffic to any DNS server and redirecting it to the ISPs' DNS servers. This is what Malaysia was planning to do.

It sounds to me like Malaysia wanted to do both...

Malaysia is already doing the first one.

Re: Malaysia backtracks on DNS redirection decision

#25

Post by csomar »

> He stressed that cybercrime issues, including access to gambling, prostitution and pornography websites, are extremely concerning and demand comprehensive solutions

They are not exactly backtracking but it seems that some of the involved parties didn't like the solution proposed (DNS redirection) and want to discuss other alternatives.

Re: Malaysia backtracks on DNS redirection decision

#26

Post by mytailorisrich »

MonkeyClub wrote: post #5
aussieguy1234 wrote: post #3

While they've backtracked, every dictator in the world probably took notice and its only a matter of time.

Greece is already way ahead! When one tries to visit some sites like LibGen, DNS is redirected to a "no-no you shouldn't go there" page, which in turn redirects to this official finger-wagging page: https://opi.gr/edppi_block/edppi_block.html DNS hijacking was also used during the beginning of the Ukraine affair as part of an EU-wide censorship push, blocking sites like the Kremlin and Pravda, though without further…

Not a very good example as LibGen is blocked by court decisions in a number of countries because of copyright infringement issues.

It's even been ordered to close by a US court (according to Wikipedia). Obviously they ignored that as they are not in the US...

Re: Malaysia backtracks on DNS redirection decision

#27

Post by StrLght »

commandersaki wrote: post #10
tedk-42 wrote: post #9

Earlier quoted context omitted.

Yes, assuming you have a non compromised browser or certificate trust chain

Tangential question: how are IP addresses in certificates validated? Cloudflare was subject to a BGP hijack of the 1.1.1/24 prefix, how does it prevent someone from running a malicious DNS server?

Technically it's possible to specify an IP address in a X.509 certificate. With OpenSSL you'd do something like that when issuing new certificate:

subjectAltName=IP:192.168.1.1

And that's actually exactly what Google's 8.8.8.8 and Cloudflare's 1.1.1.1 use in their certificates.

Also both issuers use certificate transparency [0], so BGP hijack shouldn't affect this — sure, your system might try to connect to hijacked IP, but TLS connection will fail due to invalid certificate (assuming certificate trust chain wasn't compromised and there are no malicious CAs installed on your system).

[0]: https://crt.sh/?q=1.1.1.1

Re: Malaysia backtracks on DNS redirection decision

#28

Post by oarsinsync »

netsharc wrote: post #18
defrost wrote: post #14

While the DNS Privacy Project has a good many suggestions and links it might be time to upgade their "stubby" project. https://dnsprivacy.org/ stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers. Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend e…

Off-topic: Why are you using | instead of / ? People having their unique implementation of punctuation marks irks me...

At a guess, because regex and/or coding generally. In a number of regex implementations and programming languages, | is used as an inclusive OR

Re: Malaysia backtracks on DNS redirection decision

#29

Post by [deleted] »

netsharc wrote: post #18
defrost wrote: post #14

While the DNS Privacy Project has a good many suggestions and links it might be time to upgade their "stubby" project. https://dnsprivacy.org/ stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers. Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend e…

Off-topic: Why are you using | instead of / ? People having their unique implementation of punctuation marks irks me...

[deleted]

Re: Malaysia backtracks on DNS redirection decision

#30

Post by defrost »

netsharc wrote: post #18
defrost wrote: post #14

While the DNS Privacy Project has a good many suggestions and links it might be time to upgade their "stubby" project. https://dnsprivacy.org/ stubby is a localhost DNS proxy that can work for any app | browser | etc. on a network and use DoT or DoH to any of the common providers. Given the ease with which national ISPs can MiTM these | intercept calls to Cloudflare | Quad9 | AdGuard etc. it might be good to extend e…

Off-topic: Why are you using | instead of / ? People having their unique implementation of punctuation marks irks me...

Because I've used it as an "or" symbol in a non unique common as muck manner since 1980 at least when I was taught Boolean logic in an undergraduate university mathematics class.

It's one of many conventional symbols for OR, more common in the pure ASCII days due to a lack of ∧ , ∨ , ¬ et al.

Which rock have you lived under that you've never seen it used an OR before?

People imposing their limited experience of the wide world upon others would certainly irk some, but rest easy, I've not taken offence at your odd assumption of non existent universal convention.

Post reply on HN