[Pearg] Responding to "Concerns over DNS Blocking" technical error(s)

[Marwan Fayed <[e-mail]>]

Dear wg, and more--

There is a just-published open letter [1], also summarized at 117's pearg
[2] in response to a proposed initiative that (as is summarized) can
require ISPs to block domains via DNS without a court order.

This is no doubt a concern for all, but the open letter has two significant
problems, one of which is a factual and technical error that would be great
to correct, and another that merits wider conversation:

1. [Technical Error] The open letter suggests that IP blocking is a viable
and less harmful alternative to blocking content via DNS. This is patently
false because the consequence of blocking via DNS is all content at a
domain name; an IP address block, by the very design of the Internet
Protocol itself, could affect (and has affected) many more domains than
intended [3]. For example, a block of 11 addresses in Austria last year
affected thousands of domains and websites [4]. (As an aside, the lack of
transparency about the practice is a particular concern, at least as much
as the practice itself.)

How best to address the error in the open letter? Ideally we can find a fix
as a community, and one that involves the signatories (and their
organizations, despite having signed in a personal capacity).

The text of concern that needs redress reads, "Several alternatives exist
which would avoid the concerning implications mentioned above. Domestic
Internet Service Providers (ISPs) have a number of tools at their disposal
to block infrastructure deemed malicious by French authorities. This
includes blocking HTTP/HTTPS connections to the offending site, and
blocking the IP addresses." [1]

2. [Wider conversation] The idea that the use of the DNS deserves more
attention than simply being "blanket bad." There are no doubt challenges,
not least that the DNS is composed of many role-types, namely recursive
resolvers and authoritative servers, also local-network private resolvers
and open-public resolvers. Each of these entities in the DNS are different
and warrant separate consideration.

However, when thinking about 'in-network' controls, the DNS has one very
large and important advantage that is unavailable when blocking by name or
address: The DNS offers **transparency**, which is not available when
blocking via name or address. From RFC 8914 [5], recently introduced codes
in sections 4.16 to 4.19 are useful, to start. At a minimum, support from
resolvers and clients means that users could get insight into service
interruptions, and the reasons for them.

If blocking in the network has to happen, the transparency offered by DNS
in RFC 8914 should be considered when engaging in the wider discussions.

Hopefully these comments help contribute to a positive and productive
discussion.

Many thanks,
--marwan

[1] https://medium.com/@vgcerf/concerns-over-dns-blocking-988ef546a100

[2]
https://datatracker.ietf.org/meeting/117/materials/slides-117-pearg-proposed-laws-on-dns-blocking-00

[3] https://blog.cloudflare.com/consequences-of-ip-blocking/

[4]
https://www.derstandard.de/story/2000138619757/ueberzogene-netzsperre-sorgt-fuer-probleme-im-oesterreichischen-internet

[5] https://www.rfc-editor.org/rfc/rfc8914.html