Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is DNS still hard to learn?

jvns.ca

Post reply on HN
Print view View original

151–160 of 261 posts

Re: Why is DNS still hard to learn?

#151

Post by sdf4j »

dahfizz wrote: post #133
chefandy wrote: post #56

Earlier quoted context omitted.

I'd conservatively estimate 90% of the people who make core FOSS software interface decisions haven't had to learn anything technical in an entirely unfamiliar domain where there existing mental models didn't apply in decades. Beyond that, many consider having learned these arbitrary, terse interfaces as a badge of honor, and for some reason thinks that makes them better technologists. I'll bet they'd be even better…

I disagree. The CLI is inherently a super-user oriented interface. The CLI needs to let an experienced user be as productive as possible. If you need a pretty UI with everything spelled out, you should go on GitHub and find a GUI that someone built on top of the core tool. But dumbing down the core tool is not the way to go. The --help message should be good, and the man page needs to be good, but the tool itself sho…

I disagree.

I'm a super-user and as such I have to use hundreds of tools to GTD. What you call “pretty UI” I call ergonomics. So I appreciate when the tooling is respectful of my time and don’t require me to visit the man page just because the developer was so situational myopic that thought sparing a few characters was a good idea.

It all smells like unconscious gatekeeping.

Re: Why is DNS still hard to learn?

#152

Post by 1vuio0pswjnm7 »

I'm not a "developer" and I learned DNS without any problems. Therefore agree with other commenter that DNS is not actually difficult to learn. I like the output from DNS utilities such as BIND and tinydns format.

DNS is worth learning for any internet user, IMHO. I've written primitive utilities that when used together can do stuff none of the popular DNS utilities can do. I use these every day.

Here's DNS challenge for readers. Try to look up the domain "bootable.com". Use whatever is the preferred method.

People writing about DNS often compare it to a telephone book. IMO the way most people use DNS is more like "directory assistance".

IP addresses do change but by and large most stay the same for long periods. Old zone files, publicly available scans^1 and other bulk DNS data collected from web crawls and public DNS caches comprise the "phone book" for me. Absolutely essential.

1. Sadly, in recent some of these sources have changed to non-public. No phone book for you! Call directory assistance.

Re: Why is DNS still hard to learn?

#154

Post by nineteen999 »

lannisterstark wrote: post #150
nineteen999 wrote: post #149

Another one of these articles. We learnt very easily back in the 1990's when the Internet was smaller, and the computers were much much slower and less capable. DNS, LDAP, SMTP, IMAP etc were the bread and butter of ISP's back then and people actually referred to the official documentation (RFC's etc). You had to learn them if you wanted to run servers on the Internet at all, and with a bit of an investment of time (…

Ah another one of those "dese damn kids and millennials I tell ya hwat, back in my grandpappys days we used to mine our own copper before laying them lines!"

The "get off my lawn" vibe was totally intended. Doesn't change the fact that there are a bunch of "AWS architects" out there running Terraform and building future disasters because they don't properly understand the infrastructure that the whole thing sits upon.

It's just like the morons who think that dynamic linking should be abolished for everyone, because they don't understand the use cases for distributors from a security standpoint, developers/users who require binary modules, or how to use their distributions packaging tools to avoid conflicts, and are too lazy to learn. But oh no, "ma DLL hell". Good grief.

Re: Why is DNS still hard to learn?

#155

Post by icedchai »

fps wrote: post #46
redeeman wrote: post #34

Earlier quoted context omitted.

> In the early 2000s it would have taken a network engineer with knowledge of DNS, IP, Ethernet, RFC1918, actual routing protocols and whole bunch of other stuff to set something like that up You remember things differently than I

in the very early 2000s, home routers weren't a thing. Cable modems hooked up to a single computer. If you were a business, you got a PIX, but home setups were frequently done with a computer that had 2 ethernet ports and either used Windows's "home internet sharing" or Linux's ipchains and NAT. This was typically fine, because very few houses had multiple computers. I knew many people who would get a separate cable…

What you describe is late 90's, not early 2000's. Broadband was rolling out across many areas of the US in the late 90's (@Home cable modems, DSL, etc.)

Re: Why is DNS still hard to learn?

#156

Post by hitpointdrew »

tmpX7dMeXU wrote: post #148
dahfizz wrote: post #133

Earlier quoted context omitted.

I disagree. The CLI is inherently a super-user oriented interface. The CLI needs to let an experienced user be as productive as possible. If you need a pretty UI with everything spelled out, you should go on GitHub and find a GUI that someone built on top of the core tool. But dumbing down the core tool is not the way to go. The --help message should be good, and the man page needs to be good, but the tool itself sho…

This is full of false dichotomy. Making things more understandable isn’t “dumbing them down”. There isn’t necessarily a trade-off. An application being CLI-based is not a get out of jail free card for UX critiques, nor is it an implication that it’s for power-users. You can’t just put the minimum viable effort into considering how someone will use your software without any thought to intuitive mental models and cry “…

> nor is it an implication that it’s for power-users.

Yes it is. As an administrator being a CLI tool means that I can automate configs and deployment with ansible or Nix OS. I would argue doing these sorts of automation what are what “power-users” would do.

GUI’s often lack any sort of automation capability or have some half-cocked API that usually lacks features or endpoints that would be trivial if the thing was just a CLI tool with a config file.

Re: Why is DNS still hard to learn?

#157

Post by rconti »

1vuio0pswjnm7 wrote: post #152

I'm not a "developer" and I learned DNS without any problems. Therefore agree with other commenter that DNS is not actually difficult to learn. I like the output from DNS utilities such as BIND and tinydns format. DNS is worth learning for any internet user, IMHO. I've written primitive utilities that when used together can do stuff none of the popular DNS utilities can do. I use these every day. Here's DNS challenge…

> DNS is not actually difficult to learn.

> tinydns format.

You earned my disagreement right there!

Re: Why is DNS still hard to learn?

#158

Post by rconti »

1bent wrote: post #42

djbdns is simple, easy to understand, easy to configure; it embodies a clear understanding of how DNS works. Unlike BIND and dig, it was designed after DNS had been in use for a while. Like sendmail, BIND suffers from being designed before anyone knew what it would need to do.

and logging in hex is awful and should be punished

Re: Why is DNS still hard to learn?

#159

Post by jvns »

tristor wrote: post #30

I don't agree with this article. I think DNS is something few people take the time to learn, but it's not actually hard to learn. One of the great things about DNS is that the system itself will tell you about it's internal state in response to queries. It's very easy to inspect a DNS server for a known zone and understand how it works, and there's very good tooling that's free and widely available to do this (like d…

Hello! I wrote this post and I have a couple of things to say about this "DNS is not actually hard" take. It took me many years to feel totally comfortable debugging DNS problems, and I wrote this post to explain why I think it was hard for me.

I also used to think that "no, actually, it's easy!" was an encouraging response to "this is hard to learn". And I kind of get it! I love DNS! I think it is surprisingly simple in many ways, and I've written about that a lot, for example in https://implement-dns.wizardzines.com which shows you how to implement a toy DNS resolver from scratch in some pretty simple Python code.

But over the years I've learned that "no, it's easy to learn!", instead of coming off as an encouraging comment ("you can do it!"), often gets received as "no, it's not hard, actually the problem is that you're dumb". Like, I've been confused about this for years, and you're telling me that, no, actually it's easy? Not that helpful!

So I've stopped telling people that, and instead I put a huge amount of work into trying to understand _why_ people find certain things hard and work to help remove some of those barriers.

Re: Why is DNS still hard to learn?

#160

Post by gerdesj »

jl6 wrote: post #78

It's one of those things where there is a mismatch between how easy it seems to be, and how hard it turns out to be. We all use DNS every day, and it seems really easy. The everyday language of DNS is: domain names, lookups, IP addresses. This language is exposed in browsers for all to see, and through this exposure we develop a mental model of how we think it works. But under the covers there is a whole new language…

"that weird dot after the top-level domain"

That weird dot is called root. Without it, a name is unqualified, with it the name is completely defined. That means that context is everything. Without the dot, a resolver might add the resolver's domain or parts of it, repeatedly.

Now, you and I know exactly what: host.example.co.uk is supposed to mean but without the trailing dot a resolver could try to look up host.example.co.uk.example.co.uk

Windows out of the box, if this happened would also try host.example.co.uk.example.co then host.example.co.uk.example and then host.example.co.uk.example, then host.example.co.uk. and get a result. However I never saw Windows actually try the first effort and I think the behaviour was designed to deal with large corp with DNS federated monstrosity Active Directories.

Your browser is probably toddling off to a DNS over https (DoH) server these days without your say so and canoodling with all sorts of ne'er do wells. Your DNS lookups are basic data - your ISP used to love seeing where you go. Your OS vendor (if you buy your OS) obviously can pass back "telemetry". Mr Google, doesn't own the desktop but does own the browser, so by ensuring you use "safe" DNS servers for your browser instead of whatever you have configured, its all good. All these shenanigans does make IT troubleshooting far more exciting than it used to be.

I shouldn't worry too much about trailing dots. You will almost certainly not be using the DNS servers you think you are. I get why DOH was invented and there is a good reason for some "civilians" to use it - ie a non IT specialist using a nasty wifi hotspot will be protected from some harm by their browser going home securely to do DNS lookups. However is it up to the browser vendor to trample all over the user's choice of Endpoint Security?

DNS is way more complicated than simply looking up addresses. Its about money these days (actually it always has been since around 2000) and there are now a lot of very opinionated mega corps who want to decide who profits off you.

Post reply on HN