Interesting. UK ISPs have had a similar block/filter list for many years (mostly covering copyright-infringing torrent websites and the like). But it’s more robust than a simple DNS block. A VPN can bypass the block, but changing DNS providers will not.

Worth mentioning NextDNS and ControlD under this! I migrated from the former to the latter about six months ago, but both are a solid choice.

I am curious why SNI-based block isn't used.

An excellent point!

Yes, any given domain name (or as non-technical people would think about it, "website" -- any website) could be "blocked" (re-routed to a non-functioning IP, claimed to not exist, other DNS error or malfunction, ?, ???) at any level of DNS (ISP, Local, Regional, Country, ?, ???)

A question your statement so excellently potentially suggests, is:

What's the true extent of the block?

Is it merely a DNS failure -- or are inbound/outbound packets to an IP address actively suppressed and/or modified to prevent TCP/IP connections? (i.e., The Great Firewall Of China, etc.)

You have "Bad Faith Actors" (let's not call them "governments", "countries", "nation states" or even "deep states" -- those terms are so 2024-ish, and as I write this, it's almost 2026! :-) )

Observation: Let's suppose a "Bad Faith Actor" (local or nationwide, foreign or domestic) attempts to block a website. They can accomplish this in one of 3 ways:

1) DNS Block

2) TCP/IP Block, i.e., block TCP/IP4/6 address(es), address ranges, etc.

3) Combination of 1 and 2.

#3 is what would be used if a "Bad Faith Actor" absolutely had to block the "offending" website, no ifs ands or buts!

But... unfortunately for them (and fortunately for us "wee folk"! :-) ), each of these types of blocks comes with problems, problems for them, which I shall heretofore enumerate!

From the perspective of a "Bad Faith Actor":

1) DNS Block -- a mere DNS block of a single domain name is great for granularity that is, it targets that domain name and that domain name alone, and something like this works great when a given company's products and services are directly tied to their website as their brand name (i.e., google.com being blocked in China), but it doesn't work well for fly-by-night websites -- that's because a new domain name pointing to the old IP address can simply be registered...

2) TCP/IP Address / Address Range Block -- The problem with this approach is that while it is more thorough than a simple DNS block, it may also (illegally and unlawfully, I might add!) block legitimate other users, websites and services and businesses which share the same IP or IP address range!

Think about it like this... A long time ago, all of the mail traffic for AOL (America Online), about 600,000 users or so, was coming from a single IP address. Block that IP address, and yes, you've stopped spam from the single user who is annoying you, but you've also (equal-and-oppositely!) blocked 599,999 legitimate users!

So "Bad Faith Actors" -- are "damned if they use the first method, and really damned if they use the second or third methods"... the first method is easily circumventable for non-brand name dependent websites and web services, while the second and third methods risk causing harm to legitimate users, sometimes huge amounts of them... which should be illegal and unlawful by any country's legal standards...

In other words, Countries should read their own sets of laws(!) before contemplating Internet blocks on their Citizens... :-) And not just one country either, all of them!!! :-)

Anyway, an excellent point!

Very thought stimulating -- as you can see by my ramblings! :-)

It is to me, faved.

Pretty much, yeah. Those they can't get to despite efforts.

I use an o2 DSL connection in Berlin. The domains I tested seem to resolve fine. And you can of course configure an alternate DNS. Which apparently I didn't yet on my new laptop. So, that is fixed now. Mostly that's just a performance fix. Operator DNS tends to be a bit slow to respond and it's nice to get back a few milliseconds. But I also don't mind my operator not spying on me.

Of course I also use Firefox so mostly that just bypasses the system DNS entirely and uses dns over https.

Which one is that?

I would be interested in paying a bit more if the ISP is better. In the Netherlands we always had xs4all, nowadays sorta morphed into freedom internet, which was started from a hacker magazine and kept the spirit, fighting surveillance and censorship while offering regular ISP services and then some. I'm not aware that Germany has such a thing so any step in the right direction would make me switch if I can get it (should be fine if it's available via Telekom's public network, we're currently on a virtual operator as well)

mostly to avoid the blocking. Those streaming sites used to be extremely popular here in Germany because there was an entire cottage industry (Abmahnanwälte) that used to pester uploaders with legal threats.

Not sure what the state of it is now given that commercial streaming replaced a lot of both.

I thought demonoid was dead dead?

For example soon to be released 300TB Spotify music library dump.

https://news.ycombinator.com/item?id=46338339

There is no legislation here. CUII is a private organization that generates lists of domains that contain copyright violations. ISPs voluntarily choose to block those.

> or those overrun with malware to protect users

The anti-malware companies won't lobby government to block malware as that would cut into sales of their anti virus/malware.

I knew about torrenting, due to the problem of redistributing copyright material. But pure streaming? Are you sure that is illegal in Germany?

German authorities, not Germans.

German Wikipedia was taken down twice (for "privacy", not piracy though). Still "illegal information". In the latter case about a former Stasi worker turned leftist member of parliament.

https://www.theregister.com/2006/01/20/wikipedia_shutdown/

The German Wikipedia site was taken down by court order this week because it mentioned the full name of a deceased Chaos Computer Club hacker, known as Tron. A Berlin court ordered the closure of the site on Tuesday after it sided with the parents of the German hacker, who wanted to prevent the online encyclopedia from publishing the real name of their son. A final ruling is expected in two weeks' time.

https://web.archive.org/web/20090129160045/https://cyberlaw....

By virtue of an interim injunction ordered by the Lübeck state court dated November 13, 2008, upon the request of Lutz Heilmann (Member of Parliament – “Die Linke” party), Wikipedia Germany is hereby enjoined from continuing linking from the Internet address wikipedia.de to the Internet address de.wikipedia.org, as long as under the address de.wikipedia.org certain propositions concerning Lutz Heilmann remain visible.

Germans yes, the gov with their over-regulation not

The government or even courts are not involved with these blocks.

The main complaint about these blocks is that they are managed and decided on by private companies and _not_ by the government / law.

Despite what facade?

Is it draconian that piracy sites aren't resolved by some ISPs' DNS?

Is it draconian if no Government entity is involved? And the penalty is unavailability?

I thought draconian implies that the punishment is much too high in relationship to the crime.

Maybe the whole affair is more dystopian rather than draconian: ISPs block access to media even though no law or government asked them to just so they have less hassle with rightholders.

> German government is just as draconian as the US

this is called "disinformation"