Re: [DNSOP] I-D Action: draft-vixie-dns-rpz-04.txt

[ac <[e-mail]>]

On Mon, 19 Dec 2016 09:16:28 +0100 (CET)
[e-mail] wrote:
> > > So if this is the IP of a phishing site or the IP of an command
> > > and control host that tells its bot to execute criminal action
> > > you still valid the accuracy of the answer higher then possible
> > > damage this could do to your user?
> > yes. 
> > In your example, ethically, it is a problem that should be
> > addressed on IP, not on DNS
> > 
> > It is never okay to tell lies.
> 
> Unfortunately the real world isn't that simple.
> 
it actually is.

> Sometimes you are required by law to tell lies. Case in point: Various

it still is never okay to lie and to deceive.

If the law requires you to answer example.com as ipv4 xxx.xxx.xxx.xxx

The law does not say : send "Pirate Bay" to "example.com" to deceive
your users! it may instruct you to send coca-cola.org to coca-cola.com

but I am not aware of any court (on the planet?) that instructs people
to lie, cheat, steal or deceive - maybe in the interests of national
security, etc. - but arguing that is like pulling the dam from underneath the duck.

 so, factually, the law is not instructing you to lie or to deceive.

the law is saying: do not resolve "pirate bay" or lie to your users or
deceive your users!

Why would you say (or think that?)

your reply is not addressing dishonesty at all?

This is simply  about ethics. 

is it okay to be dishonest, to deceive and where is the ethical line

More specifically: When do you become me - when there is an RFC to
describe methods to steal? - i.e more direct than fraud?


Andre

<snip - left for context>
/*
> domains belonging to Pirate Bay and several other torrent providers
> have been explicitly blocked in Norway - explicitly as in: The biggest
> ISPs in Norway (I happen to work for one of these) have been told by
> the Oslo district court to block access to a list of domains supplied
> by the court, and that this is to be implemented through DNS blocking
> (lies, if you will).
> 
> It doesn't matter whether I *like* this or not, and it also doesn't
> matter whether the domains in question are easily available by using
> OpenDNS, Google Public DNS, running your own name server, etc. ISPs
> are still required to block access as long as the verdict from the
> Oslo district court is valid.
> 
> Today this blocking is done without using RPZ. Having RPZ standardized
> and implemented in more DNS software would make it possible to perform
> the same blocking as mentioned above with fewer moving parts and thus
> a simpler system less likely to have "interesting" failure modes.
> 
> Note that it makes absolutely no difference to the blocking described
> above whether the RPZ draft is published as an RFC or not - in both
> cases the blocking would still be performed, because it is required
> by law.
> 
> Steinar Haug, AS2116

*/