A classic problem with end-to-end encryption backdoors is that most of the time there is no benefit to users or software vendors to offset the cost and risks they must take on to provide law enforcement access. I can think of just one exception, which is identity based encryption, which allows e.g. email addresses to be used as public keys. IBE requires a master secret key that is used to generate the private keys associated with each user's ID, and therefore has an inherent backdoor, but at least the users can benefit from the reduced complexity of key management.

For the most part backdoors require some kind of central coordination, so there are situations where it is basically impossible to support one. HTTPS is a good example: anyone can run a web server and there is no permission or coordination needed to do so, and so HTTPS backdoors would be difficult to create (otherwise I cannot run my web server without coordinating with whatever authority controls the backdoor, or I cannot run a secure web server without such coordination). That is what the conversation is really about: whether or not we are willing to sacrifice the most useful and valuable aspects of the Internet's design (distributed, loosely coordinated, no-permission-needed), or do without security and hope for the best, for the sake of a law enforcement backdoor.

I just realised that there might be an actual, political need for something as brittle and theatrical as DNS blocking, and probably of other things similar, because there are large masses of untechnical nature for which it really works.

Of course, we know DNS blocking doesn't fix anything. It's like putting the bad thing in storage and switching off the light. We know that nearly anyone can route around a blacklist-employing name server in seconds, but it's all the people but those "anyone" who can't.

And they probably think it's a really good idea. The general masses don't have to worry about accidentally bumping into dubious content, and it also raises, to a conscious level, the bar for those who want to bump into it. I mean, if you have to specifically install or configure things to workaround the DNS block, you've just validated your questionable intents.

For most people, that probably makes sense similarly to a signpost at a closed gate that says "Private yard / No pass through". Yeah, undoubtedly some people will open the gate and try to make the shortcut through the yard but at that point it will be clearly intentional. It's just that the externalities of DNS blocking are infinitely higher than blocking pedestrian traffic through a private yard, and no common people see that.

The rational counter-attack must thus focus on what would be a better alternative rather than how DNS blocking is flawed by design. How to prevent families from accidentally finding themselves looking at child porn, or to make it difficult for uncle Ed to watch naked kids on internet late in the evening while still preventing the ISPs from MITMing the DNS queries for everyone else?

The masses are free to opt-in to babyNet. They can use a SafeDNS provider. It can be zero-touch even. Just push a DNS / DoH resolver through DHCP for the customer. (IETF RFC is coming for DoH provisioning.)

But let the default be safe.

Of course this is usually a foreign concept to laypeople.

But to address the "accidentally CP" argument. How does that happen? You have to "accidentally" type something into Google/Bing/Yahoo and then click through. Or you "accidentally" have to start somewhere. And if you go to any for profit pornsite (camsites, streamsites, blablabla), or even just a porn subreddit, or type porn (or some explicit search terms) into a search engine.... you don't get to anything illegal. Why? Because that's bad for business.

So ... it seems like a perfect excuse. It maybe worked for the first closeted gay senator/representative... but never since. So why are we still talking about it as something that "accidentally" happens?

>How to... make it difficult for uncle Ed to watch naked kids on internet late in the evening

That's already illegal, so uncle Ed gets prosecuted like any criminal.

That is a solved problem which requires no technical or legal changes.

100% agreed that this is a less black-and-white issue than many in the HN demographic make it seem to be.

I'm not saying they are equivalent issues, but I do see a lot of parallels between the arguments made for/against weakening encryption and those made for/against gun control. It makes it tough for me to find a logically-consistent viewpoint on both that I feel good about.