Misinformation about Quad9

[ms (Michael Tremer)]

@bwoodcock

You’re moving the goalposts again.

I am not. I was telling you what we are doing.

On your website, you have a very big logo of some “donors” then. Those must give more than the average one.

@bwoodcock

So, again, are you really suggesting that we should try to be detectives, and figure out which donations are coming from for-profit organization, which from non-profits and individuals, and that unless we detect and refuse any donations coming from for-profits, we are “suspicious?” And, again, you claim to do this yourself, or know of an example of someone who does this? Or is the entire world, including yourself, “suspicious?”

Oh no. Absolutely not. That is totally up to you to decide who you accept donations from.

I exclude certain organizations or people from making donations to our project. There might be various reasons for that, but we simply to do not agree with anything that people do to make money.

I guess I have said everything I wanted to say about this. You have your means to do things. I do not care what they are and I do not want to change them. You are reading things into people’s replies and you are using that to defend yourself. I find it rather sad that you cannot take this information and try to learn from it and make your project better.

I have the feeling that some share the concerns that were pointed out in this discussion and others in our community. You taking that and twisting it the way you need is confirming at least my concerns.

The discussion has moved on to the technical side and away from Quad9 as an organisation. I am only interested in that.

@bwoodcock

That is absolutely not the case.

You said:

@bwoodcock

We don’t answer the NXDOMAIN with the authority bit set. So we don’t claim it is a DNSSEC-signed answer. The correct response will be to eventually answer with either NXDOMAIN with extended error of “blocked by policy” OR SERVFAIL with the same extended error. The debate on which is more appropriate is still unclear.

That response from your tech team states that you are doing something that is not RFC-compliant.

You withhold the correct response which is validatable and send a spoofed one. Therefore it breaks DNSSEC and neutrality.

@bwoodcock

A recursive resolver directing users to phishing sites does not seem to me like a good reason to recommend its use.

With the same reasons ISPs want to “filter” the Internet and break net neutrality. I “recommend” service providers that do not do that. I guess that is fair to do.

@bwoodcock

Failure to support DNSSEC, however, would seem to be a good reason to disrecommend.

Or being non-compliant with any other relevant RFC.