alt Hacker News> I think, usually, in those cases it's that people believe the company did not really do anywhere near everything it could - it did the bare minimum it thought it could get away with then seemed shocked it wasn't enough to matter.
Yes, and Quad9 could have done better in the German court case. At a minimum they could have asked users to register and provide proof of residency, and then could have ensured that their DNS service is offered only to registered users.
Replies
Let's take this level of user tracking for DNS would be accepted & fine by Germany as well as what folks were thinking was feasible for the company to do as a given, how does it prove the user+ip who registered is the user+ip who submitted the request instead of the place it got proxied? Or malware enabling the same?
If you can solve this for me it would actually help a lot at work :D
> At a minimum they could have asked users to register and provide proof of residency
This would have been a massive burden to them, and (as we have seen from the ongoing data leaks) a gigantic privacy risk to its users. It would have also been a big overreach, as the German ruling would have mostly impacted non-German users.