bk99.de entertain the web since 1997

bk99.de
Lutz Donnerhacke · Internet policyCurated

How network blocks come about because of sanctions

Summary

From an ISP’s perspective, Lutz Donnerhacke describes how sanctions lists lead to network blocks, overblocking and unclear responsibility between authorities and operators. The list at the time sometimes contained complete URLs instead of only domains. At least one operator who was contacted removed the linked content in question.

Ideas

  • European decisions are passed on to providers via authorities and industry associations.
  • URL lists cannot be implemented technically through DNS blocks without loss.
  • Domains can contain sanctioned and uninvolved content at the same time.
  • Overblocking hits operators and users outside the actual target of the sanctions.
  • Deleted content quickly makes static block lists factually wrong.
  • Unclear responsibility shifts legal risks onto the providers carrying out the blocks.

Insights

  • Political granularity cannot be mapped arbitrarily onto technical namespaces.
  • Lists without a verifiable justification make error correction and accountability harder.
  • Censorship infrastructure remains error-prone even when its occasion seems lawful.

Quotes

  • Betroffenen Kunden steht Schadenersatz zu. (“Affected customers are entitled to compensation.”) – Lutz Donnerhacke

Habits

  • Donnerhacke asks authorities, associations and affected operators about the basis of their respective decisions.

Facts

  • According to the author, the German Federal Network Agency communicated with providers via industry associations.

References

Critique

  • The article mainly presents the operator’s perspective and not a complete official file.
  • The legal situation and responsibilities may have changed since 2022.

Remarks

  • The text distinguishes between deleting content and blocking its transport.
  • The technical criticism is aimed particularly at disproportionate DNS blocks.

Recommendations

  • Demand a legal basis, scope and expiry date for every blocking target.
  • Continuously check targets for deletion, relocation and uninvolved content.
  • Document technical limits and expected overblocking before implementation.

Read the original article

Search the Web Archive

Lutz Donnerhacke · 2026

Misconfiguration as a Service: Answering undeliverable traffic sensibly

Lutz Donnerhacke intercepts misrouted customer traffic to private addresses and examines safe responses that calm faulty devices and make misconfigurations visible. Among other things, DNS, LDAP, ICMP and solar inverter control traffic was observed. The provider network itself used 100.64.0.0/10 for its customers.

Lutz Donnerhacke · 2001

Firewall FAQ: Security is a maintained concept

Lutz Donnerhacke’s FAQ explains firewalls as a security concept that has to be maintained continuously and clears up common misconceptions about NAT, packet filters and desktop firewalls. The preserved page calls itself the FAQ of the newsgroup de.comp.security.firewall. The available version carries the version number 0.38.

Lutz Donnerhacke · 2018

Night-time in Neuland: The firewall was not to blame

Lutz Donnerhacke reconstructs an apparent firewall failure and finds a time-dependent connection between provider maintenance, DHCP lease and manual reboots. The firewall obtained a DHCP lease with a lifetime of ten hours. The internet interface briefly dropped out at night and then came back.