Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Where is the DNS headed?

potaroo.net

Post reply on HN
Print view View original

11–20 of 57 posts

Re: Where is the DNS headed?

#11

Post by stiray »

kitteh wrote: post #9
stiray wrote: post #7

Earlier quoted context omitted.

This is also my concern. ISPs are typically located in same country making them follow the laws of that country. I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions. What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise). F…

What about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data? Do you think your ISP has better controls and a security team than some of the big CDNs and cloud providers to detect and prevent this? The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table…

That would be criminal offense - it would mean criminal investigation and quite probably a fine for ISP (negligence). It is just not worth the risk.

If we go into those waters they can also break into my house, smack me on my head, use rubberhose cryptoanalysis, decrypt my machines and copy data from there.

For 3rd party company outside of our juristiction there is nothing that protects my data, actually they will abuse them as part of their bussines model.

The data transfers are not free, if someone is setting up free DNS resolving (cloud storage, providing emails, operating system for phones,...) there is some hidden profit within (the good old: "if something is free you're the product")

For ISP I pay for their service and this is a huge difference (also regarding laws - a much broader set applies)

Re: Where is the DNS headed?

#12

Post by bawolff »

troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed.

As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the technical goals and properties your solution has?

Re: Where is the DNS headed?

#13

Post by hurtyfi »

kitteh wrote: post #9
stiray wrote: post #7

Earlier quoted context omitted.

This is also my concern. ISPs are typically located in same country making them follow the laws of that country. I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions. What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise). F…

What about your ISPs employees? Do you trust a sysadmin pulling 40-50k a year (or less) to not sell your DNS resolver data? Do you think your ISP has better controls and a security team than some of the big CDNs and cloud providers to detect and prevent this? The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table…

> The reason I bring it up is because I know a number of ISPs whose sysadmins were on the take and selling bulk regular dumps of DNS resolver data under the table to other parties for years.

Can you substantiate this claim? I've heard of ISPs in the USA who sell data, but what you're describing sounds a little bit far fetched.

Re: Where is the DNS headed?

#14

Post by tasuki »

bawolff wrote: post #12
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed. As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the…

> How hard is it to clearly and concisely list the technical goals and properties your solution has?

Very? If you find https://handshake.org/ too marketing-y (I don't) perhaps you'll find the design notes more substantial: https://handshake.org/files/handshake.txt

Re: Where is the DNS headed?

#16

Post by Santosh83 »

How is DoH a net loss to decentralization (by moving to a few major cloud providers) when DoH is merely encrypting the information to prevent MitM spying? Surely nothing stops your favourite ISP or any other local startup from providing DoH services right? Presumably the DNS servers will still talk to each other on the backend over plain text, but if a DoH front-end can be provided by ANY DNS service then how can it be accused of centralising the Internet?

Re: Where is the DNS headed?

#17

Post by troquerre »

bawolff wrote: post #12
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

Handshake sounds exactly like namecoin which has been here for a while. I guess its trying to be better by not requiring all nodes to be full nodes or something. I feel like that is not the reason why namecoin failed. As an aside, anyone else notice how it seems like all blockchain projects are annoyingly full of marketing speak, and talk in circles for the tech part. How hard is it to clearly and concisely list the…

Handshake took inspiration from predecessors like Namecoin but it’s very different. First is scope: Namecoin puts domain names on its blockchain under the .bit TLD whereas Handshake targets TLDs. It does so because Handshake aims to improve the security of TLS by shifting trust from CAs to its blockchain. The CA model is weak bc only a single CA among the thousands of CAs that your computer trusts needs to get compromised in order for your security to get compromised. And the likelihood of a single CA failure increases over time. That’s the opposite of what you want in a robust system.

With Handshake, certs can be pinned directly on the blockchain, which becomes more secure as more nodes join the network and across time as more blocks get mined on top of the pinned cert. This shifts the system from diminishing security to accumulating security. That’s the main innovation behind Handshake.

There are other differences in the issuance model as well. Namecoin’s issuance destined it for failure from day one since names are registered for a flat fee without restriction. This meant that squatters and early adopters could lock up the namespace without paying the true market price of the name. Handshake uses an auction system for name registration and releases the namespace over time (the release date is determined by hashing the name % 52), which means that names are registered for their true market price and newcomers can still register good names. This difference is critical and already playing out successfully — the highest auction was for 200k HNS, which is equivalent to $20k USD and 7/12 of the namespace is still unreleased.

Re: Where is the DNS headed?

#18

Post by mytailorisrich »

troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

Handshake does not seem to try to solve the same problem as DoH, but rather somewhat what DNSSEC is solving.

DoH's point is mostly to hide DNS traffic. DNSSEC's point is to validate a DNS record all the way to root.

The benefits on Handshake over existing solutions are unclear to me.

Re: Where is the DNS headed?

#19

Post by hamilyon2 »

stiray wrote: post #7
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

This is also my concern. ISPs are typically located in same country making them follow the laws of that country. I belive authors of the DoH idea were doing it with good intentions but road to hell is paved with good intentions. What we are doing with DoH is actually breaking decentralised internet infrastructure to centralized (or lets say, less centralized...for now) and this was never a good thing (historywise). F…

Your comment opened my eyes in a sense. DoH could be both huge net positive for people in country like Russia, where not law mandetes logging every internet request and indefinite storage of them.

At the same time it could actually hurt privacy of people already protected by law in developed countries.

Re: Where is the DNS headed?

#20

Post by skynode »

mytailorisrich wrote: post #18
troquerre wrote: post #5

There will always be a need for a shared global namespace, and DNS needs to improve its security and privacy as the world continues to rely on it. I don’t think DoH is the answer since it just shifts trust from ISPs to CDNs[1]. On the security end, there’s a new DNS protocol called Handshake ( https://handshake.org ) that’s trying to shift the root of trust from CAs to a distributed ledger. It’s still early but it sh…

Handshake does not seem to try to solve the same problem as DoH, but rather somewhat what DNSSEC is solving. DoH's point is mostly to hide DNS traffic. DNSSEC's point is to validate a DNS record all the way to root. The benefits on Handshake over existing solutions are unclear to me.

Handshake is more of a solution to a political/governance problem than a technical one.
Post reply on HN