Source
r/darknetplan•
TheEmptySet

Distributed DNS?

From what I gather, the general idea here is to make a mesh net, essentially a completely new network to replace the internet. In terms of fighting SOPA, the only thing it enables as far as I can gather is DNS blocking, right? So why not just make a distributed DNS so that we do not have to depend on the top-level providers?

I could be completely off-base here, if I am, please tell me why =)

EDIT: Something I would like to add, this idea would be to have this as a sort of backup if a website is blocked. So for something that really needs to be "secure" such as banking (which should never fall under SOPA crosshairs really), the current DNS infrastructure could be used as normal.

My idea here is to build a network such that we can implement a seamless switch in browsers from normal to distributed DNS for websites that seem blocked. Most of the websites under threat are social media and the like for which DNS attacks would not be catastrophic.

Posted Dec 23, 2011, 8:59 PM UTC · edited

6946
cheez0r•

Namecoin?

31
TheScriptKiddie•

Namecoin.

14
diederich•

Got it one, Mr. Garabaldi. :)

7
cheez0r•

Why thank you, Mr. Bester.

4
[deleted]•

came here to say this. Namecoin solves this!

3
TheEmptySetOP•

Well Namecoin is more of a seperate DNS system altogether. I am talking about mirroring the records in a distributed form.

2
ohdeno•

Then you would have to mirror SOPA as well.

1
ohdeno•

You need WoT to even make it work in theory. So how many friend keys do you have in your PGP client?

Namecoin is one alternative that bypasses that requirement. However it has the same chicken and egg problem as bitcoin. Registrars will have to become profitable, otherwise there’s no incentive to mine namecoins and the system remains vulnerable to attacks.

4
ahugenerd•

Using WoT with a proper DNSSEC implementation, we could get verified and untampered DNS requests. These could then also be encrypted in a manner similar to what OpenDNS is doing with DNSCrypt.

3
Natanael_L•

See my suggestion here: http://www.reddit.com/r/Meshnet/comments/o3wex/wotdns_web_of_trust_based_domain_name_system/

I suggest "bootstrapping" through social networks.

1
plus_EV•

Every bitcoin miner has incentive to mine namecoins now that merged mining is implemented. Bitcoin miners can mine both bitcoins and namecoins simultaneously with no hit to performance.

Namecoin currently has 1/3 the hash power as Bitcoin, which makes it nearly immune to attack.

1
ohdeno•

That’s cool

2
Sinani201•

I don't think it's possible to make distributed DNS without being able to infiltrate it. (I could be wrong about this though)

Someone else would have to own the DNS servers and encrypt it to prevent attackers.

3
joellarson•

Well the current infrastructure is prone to the same thing. It's just that we have certain companies that we put faith in to maintain a clean DNS.

2
aceex•

The Monkeysphere Project could be our answer to that. They currently focus on SSL certificates, but the personal web of trust could be used to mark trusted DNS servers as well.

2
gsan•

We all seem to get torrents just fine, despite huge companies with lot$ of re$ource$ trying to stop it. Wierd huh?

0
JW_BlueLabel•

No, its not. You don't share secure files over torrents do you? It actually wouldn't be that hard to trick a user into downloading a virus instead of the program they wanted.

3
therealPlato•

the solution is to sign your torrent file with your gpg key and rely on WoT

1
[deleted]•

[deleted]

3
dissidents•

This is such a terrible implementation...

3
[deleted]•

[deleted]

3
JW_BlueLabel•

Is a secure distributed DNS really needed? We could just make an insecure distributed DNS. Most sites right now don't use SSL and are prone to the same DNS hijacking techniques. If a secure connection is required then just use standard public key cryptography and make it the users responsibility trade keys with each other.

Secure distributed DNS would be nice, but I don't think we should get too hung up on the secure part right now. Just get distributed DNS working first and we can always implement something like namecoin later on.

3
TheEmptySetOP•

ya and mind you we are not talking about replacing the DNS infrastructure for like Banking sites which should never fall under SOPA's crosshairs, we are talking social networking and such which are almost never SSL encrypted

2
ohdeno•

We could just make an insecure distributed DNS.

That’s the hard part.

If a secure connection is required…

That’s the easy part.

1
-SubZer000z•

While it would be good for ddns (used to saying ddos), people could easily inject bad dns records and take over a darknet.. Not sure if there is an easy way to do dns or not.. IMO I think dns would have to be client side, and you could share records, but you would not look up records from someone else, you would trust your own dns.

2
charlieok•

You basically have three choices for your source of name resolution (eg DNS) data:

  • ICANN, which works with governments. Today this is pretty much everybody's source. You know what you're getting. Mostly correct but some sites may be blocked or transferred to other parties for various reasons.

  • Friends, or at least people you know. You can probably trust them but who knows how correct, complete or up to date their data is.

  • Strangers, like the kind of people who seed torrents and publish things on file sharing networks. Some of them may have great data but who knows if you can trust them. Many of them are almost certainly adversaries.

In the “strangers” category, there is an interesting wrinkle, already mentioned a few times, which I think deserves some extra description. Instead of just taking the word of “a stranger”, you can take the word of “one of more strangers with a lot of computational power behind them”. The idea being, to tamper with the data, an adversary would need to marshal more computational power (hashing power specifically) than the entire combined group of good actors. The more participants, the more resistant the system is to attack. This is the basis for the security of Bitcoin, and I am of course referring here to Namecoin.

3
HillDrag0n•

The problem with the collective computational force is the same as with file sharing. Five thousand seeds for the worst torrent.

0
charlieok•

If there's a “problem with the collective computational force”, I don't think you've described exactly what that problem is.

1
gsan•

There are ways to mitigate this (a sybil attack). One of them is used by freenet. You take data more seriously from a node that has been up for a long time. New nodes only get in your list if you have lost contact with ~20 others, and even then I think they wait to get on and take part in your routing etc. Someone suddenly invading and spamming the infrastructure would take a long long time if it is possible at all, even with a bunch of fake nodes.

Another note on the OP, SOPA does a lot more than pop a DNS entry. People get cut off from visa and mastercard. You might not be able to accept payment for your candles or quilts because the website you sell your goodies on had a user who got caught selling fake Nikes. It's like online poker. The websites were still there but you couldn't play for real any more. Now the websites aren't even there, can't even play for fun. If they aren't making money, who pays for the servers and internet? Oh this is at the time of accusation, not after you get a hearing or anything. It is not just about DNS.

3
TheEmptySetOP•

oh, I understand the implications full well. I only meant that the act doesn't take down the servers themselves so you can still access the sites, given proper routing. =)

1
jlamothe•

So back to the days of hosts files then?

1
ivix•

Why mess with success? Just run you own independent DNS service. You can easily create an alternative root. InterNIC even provide the root zone (http://www.internic.net/zones/) to get you started.

2
ohdeno•

And what army do you have to protect your root?

1
AngryDelphiDev•

This is the heart of the issue: if you're serious about bypassing a problem the alternative is to provide a standard real alternative. The question--then--is how to centralize a decentralized system (hence the issue).

1
inthenameofmine•

I've recently stumbled upon this little interesting project: https://github.com/cjdelisle/cjdns/blob/master/rfcs/Whitepaper.txt https://github.com/cjdelisle/cjdns

If even just half of it is true this will be seriously awesome.

1
Natanael_L•

They're not near DNS yet. They're working with routing right now. The name is not CJ-DNS, it's CJD-NS.

1
baggachipz•

I've had the same question, especially since every machine has a secondary means of resolving domains ... It's called a hosts file. Couldn't we simply find a way to distribute host resolution to circumvent SOPA? Obviously distributing a massive list to every machine is impractical, but a tiered or p2p means of resolution seems very feasible.

1
[deleted]•

I think we are jumping over ourselves here. Before even worrying about DNS, we need to resolve the issue of addressing and routing first.

1
jaxxed•

what is wrong with our current implementation(s) of addressing and routing?

1
nascentt•

If we start a distributed DNS, please for the love of fuck can we get rid of TLDs?

The whole TLD system is retarded.. Any decent webdev with half a brain would use location and site options to switch languages, so needing a TLD for every country is insane. No government should have control over sites within it's country. If we got rid of TLDs we'd be left with names. Facebook, Google, Youtube...

1
invalid_font_size•

From what I understand SOPA would also make it illegal to circumvent the boo king as well so keep that in mind.

-1
jaxxed•

From what I understand SOPA would also make it illegal IN THE USA to circumvent the boo king as well so keep that in mind.

FTFY

1
invalid_font_size•

Well since SOPA is a proposed US law I thought that was implied.

1
jaxxed•

The problem is bigger than that. It is a US law, but it will likely affect the whole world. Most discussions of implementation admit that even if DNS results are changed only for US customers, that traffic will be affected outside of the US.

A solution to the problem will likely come from outside of the US, in order to avoid any legal issues inside the US. I'm not sure if any US based solution is a good idea, as it seems that your congress would just change the letter of the law to affect it as well.

This is what most of us outside of the US are concerned about.

This sort of revitalises the years old argument against US control of root level DNS

1
invalid_font_size•

I agree. My original point was only to raise awareness in this thread that circumventing DNS blocks would still be considered illegal. Often people sign up for things like being a Tor exit node without thoroughly understanding the legal ramifications. I'm not saying don't circumvent, just that people should understand what that entails.

1