Quad9 DNS Resolver to exit France
79 points by mond
79 points by mond
I love the list of French institutions using q9 at the end ;)
To me that's the most hilarious part, especially seeing how big names are there, like EDF (the national energy provider).
From this experience, we know that the geoIP-based model is not only unfit from a technical perspective, but we have proven, historical evidence that using geoIP methods results in fines being levied against us by courts.
However, starting on November 24, we will no longer serve French users, thus keeping Quad9 out of danger from similar, perhaps even larger risks in the future.
How will "French users" no longer be served then ? (Asking for a French friend not living in France :)
Edit: apparently they will block AS (so can still be accessed by VPNs):
Autonomous systems are not exclusively geographically-mapped and cannot be used as a jurisdictional identifier; though it is safe to say that most of these networks have a significant portion of their user base in France.
My guess, by completely refusing to provide services to any french user or company, they get a much better argument for being outside french jurisdiction completely. They formally do not provide any services in France. Arguments that users of VPNs that bypass geoblocking could use it then becomes much easier to tackle - you've taken a hard-line stance, you're not trying to skirt around the court ruling.
Taking a quick look at the decision (IANAL, I am not a French lawyer, and I am not your lawyer), the bulk of the decision seems to be that Quad9 didn't follow the previous court order, and is therefore liable for penalties.
This is fairly normal for the court process. It doesn't matter how insane / stupid an order is, the only way to negate it is appeal or get a different order which counters the first one. And yes, this requirement applies to court orders which are illegal, abusive, etc.
You can't just ignore a court order that says you have to do something impossible.
Translating from the French order, Quad9 was supposed to:
implement ... all appropriate measures to prevent, until the date of the final match of the 2026 WTA tournament, currently scheduled for 14 November 2026, access to the identified and to IPTV sites and services not yet identified
The blocking seems to be specific to DNS:
... a penalty payment of 10,000 euros per day of delay and per domain name or subdomain remaining accessible via the services of Quad9 within three days
Later text shows that Quad9 claimed that geoblocking wouldn't work, but didn't demonstrate it to be true.
This is a key point. Courts are adversarial systems with extremely rigid rules. If the other side claims that you're a drug dealer and you don't argue, then the courts assume that the other sides statements are true.
So whatever else is going on, it looks like Quad9 didn't obey a previous order, and had insufficient arguments to convince the court of their position.
Vague fear of making less soccer money for corrupted rich people over privacy and freedom of information for everybody, French courts had a tough dilemma to solve.
I agree with them that it is the best move. But at the same time, they say this is a question of principle and that this is not feasible to identify french users while still blocking them. They also say that the courts don't understand the internet, but the courts only apply the laws. There is not a lot of leeway for the courts.
They also say that the courts don't understand the internet, but the courts only apply the laws. There is not a lot of leeway for the courts.
Well, no.
There is no reason to believe that judges are competent in technical matters. They went to law school, and have largely been insulated from the real world. Their knowledge of DNS is only what is presented to them in the court case.
beIN presents their side, and Quad9 presents their side. Then, the judges pick a winner.
If they choose to believe beIN, then Quad9 are terrible, horrible, people. If they choose to believe Quad9, then Quad9 are innocent. They have to pick one or the other.
Note that the above decision process has nothing whatsoever to do with the technical realities of DNS.
beIN could argue that DNS was the "demon name system", and that winged imps send packets around. And, the judges could believe them. That's how the court system works.*
They also say that the courts don't understand the internet, but the courts only apply the laws. There is not a lot of leeway for the courts.
In the US, courts can vacate laws in a particular case for various reasons - they narrowly don't apply, they're impossible to comply with, they violate state or federal constitutions. In some cases, this amounts to overturning the law. Of course, France has a fundamentally different legal framework, and none of this might be true there.