News for hackers. Stuff that matters.
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by spoiledtechie on Thursday April 25, 2013 @09:10AM (#5606936)
What I wonder about, is they should be the "creators" and steering committee for the worlds own PnP DNS servers... I would gladly host a small portion of DNS spaces on my machines running at home...
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by AnthonyMouse on Thursday April 25, 2013 @11:18AM (#5607667)
DNS is probably the wrong word. You want some new method of name resolution, not DNS.

The thing with DNS is that it actually works pretty well as a distributed system. There are a bunch of different people responsible for different TLDs. If the operator of one TLD is censoring you, you can use a different one.

There are really two primary concerns with DNS. The first is that even if you have a domain using a TLD whose operators are unwilling to censor it, local DNS resolvers can still try to block it. This is not that hard to fix; either use a DNS server in a different country or (if your network blocking non-local DNS) do your DNS queries over Tor or some other secure proxy. It's also one of the things that DNSSEC or DNSCurve are supposed to prevent, if anyone would ever get around to implementing either of them. So this is solvable but non-ideal because it requires all the individual end-users to do something.

The second problem is that ICANN doesn't allow just anyone to operate a TLD, which means that the TLD operators themselves become choke points. Then censorial entities who see a TLD operator refusing to censor can put pressure on them (or their home country's government) to try to force the censorship.

So what you want is really to replace ICANN and the TLD operators with something more distributed, but the question is, with what? If you want a memorable but globally unique name then you need some method for everyone in the world to agree who it is that name should refer to. Right now the method is "if the name ends in .com, it refers to who Verisign says it does" and so on for other TLDs. You have trusted entities who can authoritatively determine who controls the domain.

I think (someone correct me if I'm wrong) that namecoin is trying to fix this with something along the lines of bitcoin, where whoever uses a name first gets to keep it. The problem there is that you need a way to make sure when it becomes popular you don't end up with a land grab and all the reasonable names end up in the hands of scammers and squatters, and I'm also not sure how they're addressing transferability and abandonment.

Just thinking out loud here, but how about this: Create a version of ICANN that works like IETF. No relationship to ICANN other than to refuse to issue TLDs that have already been issued by ICANN (and hopefully vice versa). Then, if you want a TLD, you can go to this group of people (who are maybe people like EFF members or well-known security researchers or activists) and they come to a consensus about whether you should get the TLD. So if EFF asks for ".eff" they get it. If ACLU asks for ".aclu" they get it. If La Quadrature du Net asks for ".lqdn" they get it. If Debian Foundation asks for ".debian" they get it. FSF gets ".fsf" on and on. But if some scammer asks for ".bank" they can go pound sand. Maybe make them sub-domains, so you end up with ".eff.foo" and they all end in ".foo" (insert whatever you like) to reduce possible collisions with ICANN. The idea will be to have domains outside the control of ICANN or anyone in particular and issue several hundred to generally well-known and trustworthy entities who are likely to resist censorship efforts. Then those entities can issue "wikileaks.aclu" and "wikileaks.eff" to wikileaks etc., so censoring them requires censoring all the anti-censorship organizations.

Once the working group assigns a TLD, they no longer have any involvement. They don't operate any technical infrastructure. All they do is publish the name of the domain and the public key of the entity it's assigned to (which can be used to sign domains in the TLD), to serve as the authority for resolving namespace collisions. Once an assignment is made it's permanent and irrevocable. The assigned organization's public key gets published and browser and OS vendors start including it and using it to authenticate domains in the TLD, resolved using whatever distributed system you like (that part is basically a solved problem) to map names to addresses.

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by smokeyj on Thursday April 25, 2013 @01:12PM (#5608456)
Could something like Namecoin address these concerns?

https://en.bitcoin.it/wiki/Namecoin

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by ZeroCoin on Thursday April 25, 2013 @03:55PM (#5609469)
Most definitely. You are talking about the dot-bit DNS project in particular. See here for more details: http://dot-bit.org
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by gillianseed on Thursday April 25, 2013 @10:51PM (#5611235)
This was most interesting, thanks for the link. I should have my hacker credentials revoked for not picking this up on my radar.
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by livnev on Thursday April 25, 2013 @12:19PM (#5608053)
I suppose you could have an even less centralised system to resemble Tor hidden services. This transcript of Assange and Schmidt's meeting discusses this at a certain point, just grep for 'hash'[1]. That way the domain name itself is proof of its authenticity.

Couldn't you also have something akin to bitcoin's blockchain, where the identity of a domain is agreed upon by the majority of the creators of the blockchain? I don't know what the equivalent of mining would be though. Assange also suggests how domains could be made hard to make, so that they can be 'mined', creating scarcity so that "some arsehole" doesn't "register every short name themselves"[sic].

[1] http://wikileaks.org/Transcript-Meeting-Assange-Schmidt

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by AnthonyMouse on Thursday April 25, 2013 @02:48PM (#5609109)
>I suppose you could have an even less centralised system to resemble Tor hidden services. This transcript of Assange and Schmidt's meeting discusses this at a certain point, just grep for 'hash'[1]. That way the domain name itself is proof of its authenticity.

Using a hash as the name can be useful, especially where the name is only being read by a machine, e.g. you post a link and somebody can just click it, or it's part of your app which you're only using instead of an IP address in case the IP address changes. Or you can put it in a QR code or use NFC on mobile devices etc. The trouble is that it causes the name to be full of encoded data and humans can't remember it. You would still like some way of using memorable names for instances where someone is going to have to type the thing.

>Couldn't you also have something akin to bitcoin's blockchain, where the identity of a domain is agreed upon by the majority of the creators of the blockchain? I don't know what the equivalent of mining would be though. Assange also suggests how domains could be made hard to make, so that they can be 'mined', creating scarcity so that "some arsehole" doesn't "register every short name themselves"[sic].

I was thinking about something like that, it seems like the trouble is how do you calibrate the amount of work to be done. If you make it massive (like $200,000 worth of CPU time on Amazon) then you're excluding a lot of the people you wouldn't want to exclude, or causing them to waste a lot of money. But anything significantly less formidable just isn't going to solve the problem -- at $200 you can still imagine a slew of jackasses registering all the short names. Especially when they're evildoers who are using a botnet and don't actually have to pay anything for the computing resources. And that also doesn't solve the problem of scammers getting ".bank" or ".irs" or something, where the point isn't that they're getting too many names, it's that they're getting unreasonably misleading names.

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by desireco42 on Thursday April 25, 2013 @02:32PM (#5609007)
I was thinking about this for a while and I suspect many others as well. We don't really need icann in the current form. I appreciate your thoughts as they provide insight into ways to go about it that I wasn't thinking much.

What others said, something like a service behind tor, which would be immune to government interference (to a point obviously) and that would provide flexible name resolution. I think you touch on that quite a bit by saying you would give tld to anyone who asks first. I think ability to get name that is yours without affecting others who would like that name is essential.

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by ZeroCoin on Thursday April 25, 2013 @03:58PM (#5609485)
re: "The problem there is that you need a way to make sure when it becomes popular you don't end up with a land grab and all the reasonable names end up in the hands of scammers and squatters, and I'm also not sure how they're addressing transferability and abandonment."

.bit domains do expire approximately every 9 months I believe, unless you spend more namecoins to re-register them using your private key in which case you re-register said domain for 9 more months.

Abandonment happens if you no longer own the private key used to register the domain and/or you no longer make payments into the network.

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by spiritplumber on Thursday April 25, 2013 @12:24PM (#5608102)
This is good, the problem is "and hopefully vice versa". ICANN can break this by grabbing contested names and counting on the fact that 99% of users will see what they want them to.
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by AnthonyMouse on Thursday April 25, 2013 @02:32PM (#5609012)
Not really. For anyone whose device supports the new name resolution system, if the TLD it's doing a look up on is associated with a public key then there would be no reason to even use normal DNS (which is significantly less secure because it has no widely implemented method to verify that the response is authentic).
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by livnev on Thursday April 25, 2013 @10:06AM (#5607210)
I know nothing about this but given that DNS is quite low volume, distributed peer-to-peer DNS services sound really promising. It would definitely be interesting to hear someone with knowledge in this to chime in.

TPB could (inadvertently) change the structure of the internet.

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by icebraining on Thursday April 25, 2013 @10:13AM (#5607256)
Hosting DNS is already mostly distributed; that's not the hard part.

The difficulty is setting up a distributed system that can allocate domains and prevent others from tampering with the records (e.g., what if I reply to a query for gmail.com with my own IP, pointing to a phishing site?)

One possible solution is namecoin[1], which is based on bitcoin's proof-of-work protocol.

But TPB's influence is not so inadvertent: http://digitizor.com/2010/12/01/the-pirate-bay-co-founder-st...

[1]: http://dot-bit.org/Main_Page

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by livnev on Thursday April 25, 2013 @12:27PM (#5608117)
I haven't though about this carefully but I wonder what the shortcomings of the following would be: when a domain 'owner' wants to update their DNS entry, they just push out a PGP-signed (or similar) message of their new IP onto a P2P swarm, which will only propagate your message if their message verifies with their public key, from which you can then grab the entry (and verify it again for extra security). Then, registering your domain would just consist of getting the swarm to accept your public key. Of course, this could be first-come first-serve, or it could be regulated in some way. This way you could have multiple swarms, and each swarm is only governed by their own decisions.

And I suppose on a smaller scale, TPB could create their own swarm right away, and have people use it parallel to existing DNS infrastructure. Then other censored domains could jump onto their swarm.

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by vy8vWJlco on Thursday April 25, 2013 @10:47AM (#5607488)
You're right, it doesn't look like the project advertised 2 years ago got past the idea stage.

Assuming someone actually tried, however, I don't think I'd be as worried about tampering as you have suggested... Firstly, SSL and whatever certification system used in the future will still exist to prevent man-in-the-middle hijacking, meaning even if trivial to do (like defacing Wikipedia), I do not think it will occur substantially unless as a form of DDoS (as in defacing Wikipedia), and second... by implementing something like the possibility of manual pinning and upstream authority/record-source blacklisting (a common technique in P2P apps, with an anology in Wikipedia to marking a page/record "frozen" for a period due to contention), it would be possible to preserve consensus, overriding/responding to the current level of state censorship for the forseeable future. If governments more broadly dictate filters, that will change the nature of things (and of Wikipedia... They will be able to change history), but we are not there yet nor do I think we will be there on the order of 5-10 years (and something like this might slow that timeframe). I also think people are getting more vocal about the negative aspect of imaginary property enforcement. ( https://news.ycombinator.com/item?id=5606921 )

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by Kequc on Thursday April 25, 2013 @12:25PM (#5608104)
Forgive my ignorance, but how did they secure the .bit TLD in the first place? Is this part of the whole slew of new TLDs that are coming out? They must have had a benefactor to make this happen.

Er no it doesn't even seem to be on the list. http://www.newtlds.com/applications

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by AnthonyMouse on Thursday April 25, 2013 @02:58PM (#5609162)
Namecoin isn't ICANN. You install the software and whenever your machine does a lookup for the .bit TLD it uses their lookup system instead of sending it to the DNS resolver.
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by jacoblyles on Thursday April 25, 2013 @03:29PM (#5609323)
Namecoin is a very interesting project, but I prefer PPC coin's proof-of-stake algorithm to bitcoin's proof-of-work for long-term stability and robustness.
Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by zimbatm on Thursday April 25, 2013 @11:03AM (#5607580)
In the UK Virgin Media goes further and blocks the IP address of the black-listed domains. Distributing the DNS wouldn't help.

Btw implementations of distributed DNS already exist, eg: http://dot-bit.org/Main_Page

Re:Pirate Bay Finds Safe Haven in Iceland, Switches to .IS D... by fghh45sdfhr3 on Thursday April 25, 2013 @10:53AM (#5607513)
I knew AlterNIC would be back some day.