326
A German ISP tampered with their DNS - specifically to sabotage my website (lina.sh)
submitted 1 year ago by to c/piracy@lemmy.dbzer0.com
22 comments fedilink hide all child comments
 

They did similar things to block the pirate bay, I guess 💀

top 19 comments

sorted by: hot top controversial new old
[–] 56 points 1 year ago (6 children)

There's an important follow-up post. https://lina.sh/blog/cuii-gives-up

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 24 points 1 year ago (1 child)

    The Clearingstelle Urheberrecht im Internet (CUII) is a private group formed by ISPs and copyright holders. They decided what websites to block, and ISPs followed, without any court ruling. No judge was involved, no legal process.

    The members: The four largest ISPs in Germany and a bunch of copyright holders (the Motion Picture Association, Sky, ...). If they decided that a site should be blocked, the ISPs just blocked the domains from being resolved. This ran completely outside the courts, a private system made by corporations for censorship. Blocked sites included streaming services, but also sites like Sci-Hub or game piracy sites.

    In a previous blog post, I went into detail on how we trolled them:

    • We leaked their secret blocklists (the list of domains was kept secret!)
    • We exposed dozens of wrongful and outdated blocks.
    • We made them unblock a lot of domains, including some that were blocked for years.
    • ... and so much more. We just made a lot of bad press for them.

    The CUII now only coordinates blocks between ISPs after a court order. That's it. No more secret votes. No more corporate censorship. The new version of their website says: "The CUII coordinates the conduct of judicial blocking proceedings and the implementation of judicial blocking orders."

    ...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    load more comments (1 reply)
    • [–] 137 points 1 year ago (14 children)

    In Germany, we have the Clearingstelle Urheberrecht im Internet (CUII) - literally 'Copyright Clearinghouse for the Internet', a private organization that decides what websites to block, corporate interests rewriting our free internet. No judges, no transparency, just a bunch of ISPs and major copyright holders deciding what your eyes can see.

    This is worse than whatever the UK is doing IMO.

  • permalink
  • fedilink
  • source
  • hideshow 14 child comments
    •
  • [–] 78 points 1 year ago (5 children)

    Germany's been doing fucked up stuff for a while. People have literally had the police visit and gotten citations for what they said online (for example calling a politician a "penis" on social media.) It's fucked.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 13 points 1 year ago (1 child)

    That one at least got cleared up in court, and even the damn police was pissed to be instrumentalized by 1 Penis like that (not to mention the societal backlash). In many cases it's even legitimate to have police involved, like with wild racist deathwishes in Facebook… but they indeed went way too far in too many cases.

    Surely some more Chatcontrol and big cousin Palantir will fix that, right? …right? 🫠

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    load more comments (1 reply)
  • [–] [S] 31 points 1 year ago (7 children)

    Recently they switched to a more public court-order based approach.

    But my thought on this is as well: Once their domain name servers are configured according to law, can they force us to not use other domain name services?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 22 points 1 year ago (2 children)

    Theoretically an ISP can block all outgoing queries to the DNS port 53 except to whitelisted servers, but now DNS over HTTPS exists, haven’t looked into how blockable that one is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 9 points 1 year ago (3 children)

    They probably can just block IPs of foreign DNS but I suspect there's ways of mirroring around that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 9 points 1 year ago* (last edited 1 year ago) (2 children)

    There is DoT, DoH and oblivious dns techniques. The problem is - users will have to configure those and aint nobody got time for that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
    • 15 comments in c/technology@lemmy.world view that post
    [–] 161 points 1 month ago (2 children)

    And the follow up post “Germany's private internet censorship organization gives up” from around 5 months later.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
    • [–] 30 points 1 month ago (1 child)

    CUII provides a great list of sites you'd definitely want to avoid these days. Especially if you use another DNS than the one of the ISP, which renders the blocks useless! Stay safe and make sure to regularly check their list of highly illegal sources for all kind of stuff so you are always up to date and know what to avoid as the law abiding citizen you are!

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] 3 points 1 month ago

    I don't usually pirate content in spanish, but whenever someone asks me for it, I always go to the latest blocked domain list from the govt to find piracy sites. It's such a nice and convenient list with all the latest sites.

    I don't even need to use a VPN, since most of the blocks are just DNS. I have my own DNS resolver using unbound at home, so none of those blocks affect me.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 4 points 1 month ago (7 children)

    Ey, du hast Linux installiert, du weißt ganz genau was du machen musst. Ändere einfach deine DNS Einstellungen, sodass du nicht mehr das DNS durch den Router beziehst.

    okay but I still need detailed instructions to follow step by step :(

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 5 points 1 month ago (6 children)

    https://support.nordvpn.com/hc/en-us/articles/20094975629585-Change-your-DNS-servers-on-Linux

    8.8.8.8 is Google dns and pretty quick. You can also search to find some more privacy focused dns servers (but always remember if you aren't paying for it you're the product).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 6 points 1 month ago* (last edited 1 month ago)

    No. Not enough, still often overridden by router or whatever.

    Edit /etc/NetworkManager/NetworkManager.conf:

    [main]
dns=0
rc-manager=unmanaged

    Full file I suggest

    # Configuration file for NetworkManager.
# See "man 5 NetworkManager.conf" for details.
[main]
hostname-mode=none
dns=0
rc-manager=unmanaged

[device]
wifi.scan-rand-mac-address=yes

[connection]
ethernet.cloned-mac-address=random
wifi.cloned-mac-address=random
connection.mdns=0
connection.llmnr=0

[ipv6]
addr-gen-mode=1
ip6-privacy=2

    And disable/delete "Avahi".

    Restart NetworkManager twice. If you don't know how, restart the computer twice. No, I don't know why twice. Now, edit /etc/resolv.conf:

    nameserver 2001:470:1f15:b80::53
nameserver 91.190.185.43

    Servers grabbed from here: https://servers.opennic.org/ (OpenNIC itself is kinda barely holding but the servers are pretty good).

    Note that your browser will ignore this. Open up Firefox (or derivative), Settings, Privacy and security, DNS over HTTPS, Own settings, Own, and paste something like https://dns1.slowb.ro/dns-query into it. Again, you can grab a server from opennic (look into description for URL). No, you cannot use opennic.glue addresses here.

    Now, note that this may still be tampered with, if your ISP/government cares enough. Not in the browser, but system wide yes. In this case, you will have to use dnssec-proxy, route your DNS over I2P/Tor OR run your own resolver. In all of these scenarios, you will have to make sure the program providing it is listening on port 53 (and nothing else is taking it) then just make /etc/resolv.conf this instead:

    nameserver ::1
nameserver 127.0.0.1

    Obviously, all of this only affects DNS tampering and nothing else.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 4 points 1 month ago (2 children)

    I would more recommend Quad9 instead of google. It also has some Addblock and anti tracker functionality, it also supports dns sec and dns over https. https://quad9.net/ Here the default dns resolver 9.9.9.9

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 1 month ago

    I'm happily using dnsforge.de. Free ad blocking at the DNS level. Makes silly mobile games incapable of showing their ads as well, as a bonus. Much better environment for my kids, because these ads be TRIPPIN yo.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 1 month ago (1 child)

    I use NextDNS. I'd pay but don't exceed the limit of queries. Who has a paid option that are not assholes. (Love that sweet domain filtering)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 1 month ago

    If you have a spare raspberry pi and don't mind an afternoon to get everything setup you could do what I have which is adguard home using the OISD block list and any other dns requests get resolved by unbound running on the same hardware so you're your own dns server.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 3 points 1 month ago

    Telefonica is a Spanish ISP tho. It does operate in Germany, but the ISP is spanish. It's in the name c'mon.

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 1 month ago

    So why isn't this an article in regional and national newspapers, showing the rather sinister behavior of an organization that works to silence the free flow of information?

  • permalink
  • fedilink
  • source
    •
    7 comments in c/pulse_of_truth@infosec.pub view that post
    [+] 5 points 1 year ago* (last edited 1 year ago) (6 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 2 points 1 year ago (5 children)

    So there's obviously alternatives like Mullvad and AdGuard, but those have the potential to evolve into the same corporatist setup as google and cloud flare.

    Are there any decentralized solutions that one could use to replace these? The structure of DNS says to me there probably isn't, but looking to see if you know something I don't.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [+] 2 points 1 year ago (4 children)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 1 year ago (3 children)

    we must stay nible.

    Is that like "stay hungry", but not too hungry?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
    • 2 comments in c/hackernews@lemmy.bestiver.se view that post
    [–] 3 points 1 year ago (1 child)

    Wouldn’t this form of website blocking only work if the user uses their dns?

    Would self hosting an unbound server bypass all of this?

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •