I kind of wish they start sending records in randomized order to take out all the broken implementations that depend on such a fragile property
[deleted]
What came first: the CNAME or the A record?
21–30 of 170 posts
Re: What came first: the CNAME or the A record?
#22It's remarkable that the ordinary DNS lookup function in glibc doesn't work if the records aren't in the right order. It's amazing to me we went 20+ years without that causing more problems. My guess is most people publishing DNS records just sort of knew that the order mattered in practice, maybe figuring it out in early testing.
Re: What came first: the CNAME or the A record?
#23A great example of Hyrum's Law: "With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody." combined with failure to follow Postel's Law: "Be conservative in what you send, be liberal in what you accept."
Postel's law is considered more and more harmful as the industry evolved.
I think it is okay to accept liberally as long as you combine it with warnings for a while to give offenders a chance to fix it.
Re: What came first: the CNAME or the A record?
#24> However, we did not have any tests asserting the behavior remains consistent due to the ambiguous language in the RFC. Maybe I'm being overly-cynical but I have a hard time believing that they deliberately omitted a test specifically because they reviewed the RFC and found the ambiguous language. I would've expected to see some dialog with IETF beforehand if that were the case. Or some review of the behavior of com…
I took it as being "we wrote the tests to the standard" and then built the code, and whoever was writing the tests didn't read that line as a testable aspect.
Fair enough.
Re: What came first: the CNAME or the A record?
#25It's remarkable that the ordinary DNS lookup function in glibc doesn't work if the records aren't in the right order. It's amazing to me we went 20+ years without that causing more problems. My guess is most people publishing DNS records just sort of knew that the order mattered in practice, maybe figuring it out in early testing.
I think it's more of a server side ordering, in which there were not that many DNS servers out there, and the ones that didn't keep it in order quickly changed the behavior because of interop.
CNAMES are a huge pain in the ass (as noted by DJB https://cr.yp.to/djbdns/notes.html)
Re: What came first: the CNAME or the A record?
#26It's remarkable that the ordinary DNS lookup function in glibc doesn't work if the records aren't in the right order. It's amazing to me we went 20+ years without that causing more problems. My guess is most people publishing DNS records just sort of knew that the order mattered in practice, maybe figuring it out in early testing.
It's more likely because the internet runs on a very small number of authorative server implementations which all implement this ordering quirk.
Re: What came first: the CNAME or the A record?
#27Earlier quoted context omitted.
Postel's law is considered more and more harmful as the industry evolved.
I think it is okay to accept liberally as long as you combine it with warnings for a while to give offenders a chance to fix it.
The Python 3 community was famously divided on that matter, wrt Python 3. Now that it is over, most people on the "accept liberally" side of the fence have jumped sides.
Re: What came first: the CNAME or the A record?
#28Nice analysis. Boy I can’t imagine having to work at Cloudflare on this stuff. A month to get your “small in code” change out only to find some bums somewhere have written code that will make it not work.
Or when working on massive infrastructure like this, you write plenty of tests that would have saved you a month worth of work. They write reordering, push it and glibc tester fires, fails and you quickly discover "Crap, tests are failing and dependency (glibc) doesn't work way I thought it would."
I suspect that if you could save them this time, they'd gladly pay you for it. It'll be a bit of a sell, but they seem like a fairly sensible org.
Re: What came first: the CNAME or the A record?
#29Earlier quoted context omitted.
Postel's law is considered more and more harmful as the industry evolved.
I think it is okay to accept liberally as long as you combine it with warnings for a while to give offenders a chance to fix it.
"Warnings" are like the most difficult thing to 'send' though. If an app or service doesn't outright fail, warnings can be ignored. Even if not ignored... how do you properly inform? A compiler can spit out warnings to your terminal, sure. Test-runners can log warnings. An RPC service? There's no standard I'm aware of. And DNS! Probably even worse. "Yeah, your RRs are out of order but I sorted them for you." where would you put that?
Re: What came first: the CNAME or the A record?
#30> While in our interpretation the RFCs do not require CNAMEs to appear in any particular order, it’s clear that at least some widely-deployed DNS clients rely on it. As some systems using these clients might be updated infrequently, or never updated at all, we believe it’s best to require CNAME records to appear in-order before any other records. That's the only reasonable conclusion, really.
And I'm glad they came to it. Even if everyone else is wrong (I'm not saying they are) sometimes you just have to play along.